{"id":"CVE-2013-1895","aliases":["DEBIAN-CVE-2013-1895","EUVD-2020-0151","GHSA-r838-q6jp-58xx","PYSEC-2020-249","UBUNTU-CVE-2013-1895"],"status":"published","title":"Improper Restriction of Excessive Authentication Attempts in py-bcrypt","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02835,"percentile":0.86738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2020-01-28T14:30:24Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"PyPI","package":"py-bcrypt","fixed_in":["0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-bcrypt","fixed_in":["0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-bcrypt","fixed_in":["0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-bcrypt","fixed_in":["0.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"py-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"py-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3"}]}],"versions":["0.1","0.2"]},{"source":"osv","ecosystem":"PyPI","package":"py-bcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3"}]}],"versions":["0.1","0.2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"py-bcrypt","product":"py-bcrypt"},{"vendor":"python","product":"py-bcrypt"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/03/26/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","Tool Signature","advisory","web"]},{"url":"http://www.securityfocus.com/bid/58702","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83039","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1895","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r838-q6jp-58xx","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/py-bcrypt/PYSEC-2020-249.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1895","tags":["advisory"]},{"url":"https://github.com/grnet/python-bcrypt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2013-1895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1895","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-1895","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T14:30:24Z","modified":"2024-08-06T15:20:37.112Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2020-0151","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T14:30:24Z","modified":"2024-08-06T15:20:37Z","updated_at":"2026-11-03T01:56:40.030926Z"}],"ghsa":[{"id":"GHSA-r838-q6jp-58xx","title":"Improper Restriction of Excessive Authentication Attempts in py-bcrypt","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2021-10-12T16:31:22Z","modified":"2024-10-21T20:07:00Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2013-1895","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T15:15:14.343Z","modified":"2026-06-16T23:52:19.253Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"CVE-2013-1895","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T15:15:14Z","modified":"2026-04-10T03:43:19.006706Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1895","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T15:15:14.343Z","modified":"2026-09-01T20:03:15.67057254Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"GHSA-r838-q6jp-58xx","title":"Improper Restriction of Excessive Authentication Attempts in py-bcrypt","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2021-10-12T16:31:22Z","modified":"2024-10-21T20:25:28.584726Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2013-1895","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"withdrawn","published":"2020-01-28T15:15:00Z","modified":"2025-07-16T07:31:12.345604Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:06.854805Z"},{"id":"PYSEC-2020-249","description":"The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.","status":"published","published":"2020-01-28T15:15:00Z","modified":"2023-11-08T03:57:16.070357Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}