python-websockets/websockets

python-websockets/websockets

websockets.readthedocs.io

Releases49

Frequency3 months 5 days

Last Release10 days ago

Stars5.7K

Library for building WebSocket servers and clients in Python

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2021-33880NVD↗	< 9.1	Jun 6, 2021Sunday, 6 June 2021, 15:15	5.9 MEDIUM	2.6 LOW
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
CVE-2018-1000518NVD↗	= 4.0, >= 4.0, < 5.0, < 5.0	Jun 26, 2018Tuesday, 26 June 2018, 16:29	7.5 HIGH	5 MEDIUM
aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.