{"action":"Upgrade websockets to 9.1 or later.","affected":[{"fixed":"9.1","introduced":"0"}],"component":"websockets","cve_ids":["CVE-2021-33880"],"ecosystem":"PyPI","epss":0.02265,"exploited":false,"fixed_versions":["9.1"],"ghsa_id":"GHSA-8ch4-58qp-g3mp","id":"tcs_01M5KGFVVHAAWA3QG19W3J2PCS","modified_at":"2023-11-08T04:06:06.475813Z","published_at":"2021-06-06T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-95","https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0","https://github.com/advisories/GHSA-8ch4-58qp-g3mp"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-95","url":"https://osv.dev/vulnerability/PYSEC-2021-95"}],"summary":"The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An a"}