Arch Linux Security Advisory ASA-202106-26 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-2040 Summary ======= The package python-websockets before version 9.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 9.1-1. # pacman -Syu "python-websockets>=9.1-1" The problem has been fixed upstream in version 9.1. Workaround ========== None. Description =========== The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Impact ====== A remote attacker could guess HTTP Basic Authentication passwords using a timing attack. References ========== https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f78... https://security.archlinux.org/CVE-2021-33880