id: PYSEC-2020-249
details: The py-bcrypt module before 0.3 for Python does not properly handle concurrent
  memory access, which allows attackers to bypass authentication via multiple authentication
  requests, which trigger the password hash to be overwritten.
affected:
- package:
    name: py-bcrypt
    ecosystem: PyPI
    purl: pkg:pypi/py-bcrypt
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: '0.3'
  versions:
  - '0.1'
  - '0.2'
references:
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/03/26/2
- type: WEB
  url: http://www.securityfocus.com/bid/58702
- type: ADVISORY
  url: https://github.com/advisories/GHSA-r838-q6jp-58xx
aliases:
- CVE-2013-1895
- GHSA-r838-q6jp-58xx
modified: '2021-08-27T03:22:16.441551Z'
published: '2020-01-28T15:15:00Z'