PyPI/srp CVE-2021-4286: high 7.5, EPSS 0.74%

cocagne pysrp vulnerable to side channel leaks

Action: Upgrade srp to 1.0.17 or later.

pip install srp==1.0.17

Affected

Fixed versions

Sources

• osv: GHSA-xmc3-9m9j-w9x4
• https://nvd.nist.gov/vuln/detail/CVE-2021-4286
• https://github.com/cocagne/pysrp/pull/43
• https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f
• https://github.com/cocagne/pysrp
• https://github.com/cocagne/pysrp/releases/tag/1.0.17
• https://github.com/pypa/advisory-database/tree/main/vulns/srp/PYSEC-2022-43014.yaml
• https://vuldb.com/?ctiid.216875
• https://vuldb.com/?id.216875

CVE-2021-4286 · published 2022-12-27T12:30:20Z · modified 2024-10-28T14:52:55.614843Z · JSON