{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.0.15"}],"component":"openslides","cve_ids":["CVE-2024-22893"],"ecosystem":"PyPI","epss":0.00359,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGMYZ3PNJ5EB3H8ZDM0S6H","modified_at":"2026-05-21T15:00:25.352989963Z","published_at":"2024-09-25T15:15:13.520Z","references":["https://osv.dev/vulnerability/PYSEC-2024-290","https://gist.github.com/mdickopp/10e4a4ba3d7ded8315a1613ee7f2541e"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-290","url":"https://osv.dev/vulnerability/PYSEC-2024-290"}],"summary":"OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing"}