CVE-2013-1895

Description

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/83039

http://www.securityfocus.com/bid/58702

http://www.openwall.com/lists/oss-security/2013/03/26/2

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3