ASA-202106-26 log generated external raw

[ASA-202106-26] python-websockets: private key recovery
Arch Linux Security Advisory ASA-202106-26 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : Summary ======= The package python-websockets before version 9.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 9.1-1. # pacman -Syu "python-websockets>=9.1-1" The problem has been fixed upstream in version 9.1. Workaround ========== None. Description =========== The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Impact ====== A remote attacker could guess HTTP Basic Authentication passwords using a timing attack. References ==========