Homepage

passlib@1.3.1 vulnerabilities

comprehensive password hashing framework supporting over 30 schemes

  • latest version

    1.7.4

  • latest non vulnerable version

    1.7.4

  • first published

    13 years ago

  • latest version published

    4 years ago

  • licenses detected

  • View passlib package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the passlib package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cryptographic Weakness

    Affected versions of this package are vulnerable to Cryptographic Weakness. The SHA-256 prehash is unsalted, meaning the resulting bcrypt digest is vulnerable to breach correlation attacks.

    How to fix Cryptographic Weakness?

    Upgrade passlib to version 1.7.3 or higher.

    [,1.7.3)
    • M
    Denial of Service (DoS)

    Affected versions of passlib are vulnerable to Denial of Service (DoS) attack.

    passlib is enable wildcard password by default, which allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.

    How to fix Denial of Service (DoS)?

    Upgrade passlib to version 1.4 or higher.

    [,1.4)
    Go back to all versions of this package