CVE-2016-9243 Improper input validation in cryptography
HighCVSS 7.5
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cryptography(PyPI) | < 1.5.3 | 1.5.3 |
| pypi cryptography(PyPI) | = 0.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.2.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.2.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.3 | No fix listed |
| pypi cryptography(PyPI) | = 0.4 | No fix listed |
| pypi cryptography(PyPI) | = 0.5 | No fix listed |
| pypi cryptography(PyPI) | = 0.5.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.5.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.5.3 | No fix listed |
| pypi cryptography(PyPI) | = 0.5.4 | No fix listed |
| pypi cryptography(PyPI) | = 0.6 | No fix listed |
| pypi cryptography(PyPI) | = 0.6.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.7 | No fix listed |
| pypi cryptography(PyPI) | = 0.7.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.7.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.8 | No fix listed |
| pypi cryptography(PyPI) | = 0.8.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.8.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.9 | No fix listed |
| pypi cryptography(PyPI) | = 0.9.1 | No fix listed |
| pypi cryptography(PyPI) | = 0.9.2 | No fix listed |
| pypi cryptography(PyPI) | = 0.9.3 | No fix listed |
| pypi cryptography(PyPI) | = 1.0 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cryptography(PyPI) | = 1.0.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.0.2 | No fix listed |
| pypi cryptography(PyPI) | = 1.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.1.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.1.2 | No fix listed |
| pypi cryptography(PyPI) | = 1.2 | No fix listed |
| pypi cryptography(PyPI) | = 1.2.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.2.2 | No fix listed |
| pypi cryptography(PyPI) | = 1.2.3 | No fix listed |
| pypi cryptography(PyPI) | = 1.3 | No fix listed |
| pypi cryptography(PyPI) | = 1.3.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.3.2 | No fix listed |
| pypi cryptography(PyPI) | = 1.3.3 | No fix listed |
| pypi cryptography(PyPI) | = 1.3.4 | No fix listed |
| pypi cryptography(PyPI) | = 1.4 | No fix listed |
| pypi cryptography(PyPI) | = 1.5 | No fix listed |
| pypi cryptography(PyPI) | = 1.5.1 | No fix listed |
| pypi cryptography(PyPI) | = 1.5.2 | No fix listed |
| debian/python-cryptography(Debian:12) | < 1.5.3-1 | 1.5.3-1 |
| debian/python-cryptography(Debian:13) | < 1.5.3-1 | 1.5.3-1 |
| debian/python-cryptography(Debian:14) | < 1.5.3-1 | 1.5.3-1 |
| cryptography.io cryptography | <= 1.5.2 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- cryptography.io release-notes third-party-advisory
- github.com vendor-advisory
- github.com product
- github.com
- FEDORA-2016-e77c8c1f3b mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-2d90e27e50 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-d3a2b640ce mailing-list third-party-advisory vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- [oss-security] 20161109 Re: CVE Request: Cryptography 1.5.3: HKDF might return an empty byte-string mailing-list patch vdb-entry
- 94216 broken-link third-party-advisory vdb-entry
- USN-3138-1 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2016-9243 vendor-advisory