Description
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| py-bcrypt | py-bcrypt | before 0.3 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.htmlThird Party Advisory, Tool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/58702Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039Third Party Advisory, VDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.htmlThird Party Advisory, Tool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/58702Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039Third Party Advisory, VDB Entry
Timeline
- Published
- Jan 28, 2020
- Last modified
- Jun 16, 2026
- NVD status
- Modified