CVE-2021-33880: 
Python vulnerability analysis and mitigation

The aaugustin websockets library before version 9.1 for Python contains a timing attack vulnerability (CVE-2021-33880) when HTTP Basic Authentication is enabled. The vulnerability was discovered in version 8.0 and fixed in version 9.1 (NVD).

The vulnerability stems from using non-constant time comparison for password validation in HTTP Basic Authentication. The issue was fixed by implementing constant-time comparison using hmac.compare_digest() instead of direct string comparison for password validation (Github Commit). The vulnerability has a CVSS score of 5.9 (Medium severity) (Oracle Advisory).

The vulnerability could allow an attacker to perform timing attacks on HTTP Basic Auth passwords, potentially leading to unauthorized access by inferring password information through timing differences in the authentication process (NVD).

Users should upgrade to websockets version 9.1 or later which implements constant-time password comparison using hmac.compare_digest(). The fix was implemented through a security patch that changes how password validation is performed (Github Commit).