CVE-2021-33880: Oracle Communications Cloud Native Core Policy

Medium severity, CVSS 5.9. EPSS: 2.3% chance of exploitation in the next 30 days.

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Affected products

• Oracle Communications Cloud Native Core Policy: version 1.14.0 only
• Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.5.0 only
• Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only
• Oracle Communications Cloud Native Core Unified Data Repository: version 1.14.0 only
• Websockets Project Websockets: before 9.1 (fixed in 9.1)

Published 2021-06-06. Last modified 2026-06-17.