python-websockets/websockets

python-websockets/websockets

websockets.readthedocs.io

Releases47

Frequency3 months 5 days

Last Release 5 months ago

Stars5.69K

Library for building WebSocket servers and clients in Python

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2021-33880 ↗	Jun 6, 2021Sunday, 6 June 2021, 15:15	5.9 MEDIUM	2.6 LOW
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
CVE-2018-1000518 ↗	Jun 26, 2018Tuesday, 26 June 2018, 16:29	7.5 HIGH	5 MEDIUM
aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.