CVE-2013-1895

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-28 · updated 2026-06-16
Weakness: CWE-307

Description

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

Affected products

Fedoraproject Fedora: 17, 18
Python Py-Bcrypt: before 0.3 — fixed in 0.3

How to fix

Upgrade to a fixed version: Python Py-Bcrypt 0.3. Check the vendor advisory for mitigations.

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
http://www.openwall.com/lists/oss-security/2013/03/26/2
http://www.securityfocus.com/bid/58702
https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
http://www.openwall.com/lists/oss-security/2013/03/26/2
http://www.securityfocus.com/bid/58702
https://exchange.xforce.ibmcloud.com/vulnerabilities/83039

Get alerted when CVE-2013-1895 or the next vulnerability affects your stack