CVE-2013-1895
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
El módulo py-bcrypt versiones anteriores a 0.3 para Python, no maneja apropiadamente el acceso concurrente a la memoria, que permite a atacantes omitir la autenticación por medio de múltiples peticiones de autenticación, lo que desencadena que el hash de contraseña se sobrescriba.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-02-19 CVE Reserved
- 2020-01-28 CVE Published
- 2024-06-25 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-307: Improper Restriction of Excessive Authentication Attempts
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html | Third Party Advisory |
|
| http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html | Third Party Advisory |
|
| http://www.openwall.com/lists/oss-security/2013/03/26/2 | Mailing List |
|
| http://www.securityfocus.com/bid/58702 | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Python Search vendor "Python" | Py-bcrypt Search vendor "Python" for product "Py-bcrypt" | < 0.3 Search vendor "Python" for product "Py-bcrypt" and version " < 0.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 17 Search vendor "Fedoraproject" for product "Fedora" and version "17" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 18 Search vendor "Fedoraproject" for product "Fedora" and version "18" | - |
Affected
| ||||||