Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2013-1895

Date: January 28, 2020

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

Language: Python

Severity Score

Related Resources (10)

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
http://www.securityfocus.com/bid/58702
https://github.com/advisories/GHSA-r838-q6jp-58xx
https://github.com/grnet/python-bcrypt
https://github.com/pypa/advisory-database/tree/main/vulns/py-bcrypt/PYSEC-2020-249.yaml
https://nvd.nist.gov/vuln/detail/CVE-2013-1895
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
http://www.openwall.com/lists/oss-security/2013/03/26/2
https://www.mend.io/vulnerability-database/CVE-2013-1895

Severity Score

Weakness Type (CWE)

Improper Restriction of Excessive Authentication Attempts

CWE-307

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us