Your message dated Sun, 29 Aug 2021 18:48:37 +0000
with message-id <[email protected]>
and subject line Bug#989561: fixed in python-websockets 9.1-1
has caused the Debian Bug report #989561,
regarding python-websockets: CVE-2021-33880
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
989561: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989561
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-websockets
Version: 8.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for python-websockets.
CVE-2021-33880[0]:
| The aaugustin websockets library before 9.1 for Python has an
| Observable Timing Discrepancy on servers when HTTP Basic
| Authentication is enabled with
| basic_auth_protocol_factory(credentials=...). An attacker may be able
| to guess a password via a timing attack.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2021-33880
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33880
[1]
https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-websockets
Source-Version: 9.1-1
Done: Piotr Ożarowski <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-websockets, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Piotr Ożarowski <[email protected]> (supplier of updated python-websockets
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 29 Aug 2021 20:13:45 +0200
Source: python-websockets
Architecture: source
Version: 9.1-1
Distribution: unstable
Urgency: medium
Maintainer: Piotr Ożarowski <[email protected]>
Changed-By: Piotr Ożarowski <[email protected]>
Closes: 989561
Changes:
python-websockets (9.1-1) unstable; urgency=medium
.
[ Debian Janitor ]
* Bump debhelper from old 11 to 12.
* Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
Repository-Browse.
* Update standards version to 4.5.0, no changes needed.
.
[ Ondřej Nový ]
* d/control: Update Vcs-* fields with new Debian Python Team Salsa
layout.
.
[ Sandro Tosi ]
* Use the new Debian Python Team contact name and address
.
[ Piotr Ożarowski ]
* New upstream release
- fixes CVE-2021-33880 (closes: 989561)
Checksums-Sha1:
aaf376ce96cd80b9d3f476ac8945d6672efd1c49 2083 python-websockets_9.1-1.dsc
428e6ab68d9a79f39b0c43e05e04b04fd0ece65e 76694
python-websockets_9.1.orig.tar.gz
bb59343a1532a50dd0a40288237d8a2089df1e6b 3224
python-websockets_9.1-1.debian.tar.xz
23b3ca0260bfc0ee1c5baf6361cc36d960ed7371 6671
python-websockets_9.1-1_amd64.buildinfo
Checksums-Sha256:
fb01950b9c3fb1e3aea777b088fae6aeb93d801fd99eb3f64c0b65b1771c5ada 2083
python-websockets_9.1-1.dsc
276d2339ebf0df4f45df453923ebd2270b87900eda5dfd4a6b0cfa15f82111c3 76694
python-websockets_9.1.orig.tar.gz
dbef42336789a8a97376e99c9d4f0e1cef41a0f246930d48cf3f5d7556461d75 3224
python-websockets_9.1-1.debian.tar.xz
b5cfe3e13f8c087bfe6627e4a5d2392f800b4daf73fe1944934d24ff5b32e41e 6671
python-websockets_9.1-1_amd64.buildinfo
Files:
c88936170311c28385304a5038dc0b56 2083 python optional
python-websockets_9.1-1.dsc
cc76058a2c2c682dac445b2f9684b7cc 76694 python optional
python-websockets_9.1.orig.tar.gz
519149c69a15d30d299f49786f79d114 3224 python optional
python-websockets_9.1-1.debian.tar.xz
dbca699b2dd3b9c608c79b08cc201b5c 6671 python optional
python-websockets_9.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEHS+omFjar2IXhi33rvbxoqdFdkUFAmEr0DAACgkQrvbxoqdF
dkUK6w/9HE5OU2y/CkCeJ7c4+t5eTJWD0dxMUtvH0BJjYhEDkHxXBIIVOVepM6Ry
xybDmUQNNnaSrHpCfxRASXvFBmMJyeVMpV3RsYmbjEq0cOW6TrFg/rtGVUVPhoNY
K9rQLnRe929eR6oIHwEmVrmLBoc+5lE7Stlo4n5lBIQ7fVm5bo7agfT+icEcsgOA
HBmsqs0BcNxs+63P9xoysaOtCd8AhD03fgzt9ObODCaUTFxma/yHlROIGxaQqydG
bGhsaOn12jCZKIvwe9nAgurZgz1aUtCwZ4zH2m8y/nvjBJPz2XorlAUFUPZ2TC4o
kiWXLK9ltXgyWkweTQKyFs98AR0/LeJEQ1h0zbHuCDXUI/9FNcbzt9fmoFs21ef2
HohHeZ8rTEIEkU5gAnvYMhM2WNQ69VEEjnkX93KJ/2kVhiOpBsAno5XNNh6n88Ac
515xpEIoMCi10BPMBv69DJPVAaSSMdIYKR+FZqpDN290a2LIA3AoY70T8dluMy0j
mcjrWjOC0kQY6mzZYtJrDAgcdK94nZOQE/W+l7upMbI22Bl+Uad/USDaq5zZmnnO
nTObEYFxNX2zVfnCvXBm0edP7cdoq2XgN94WiLxd+G8kNVuacUEZoM7XYM8qJt/I
ZEzCq7/ktH/0IaK8nQ0Ah6rYqenakSmSfIRG3GwfQqkKC6plhFc=
=B0Vw
-----END PGP SIGNATURE-----
--- End Message ---
