CVE-2018-15560 PyCryptodome integer overflow vulnerability
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pycryptodome(PyPI) | < 3.6.6 | 3.6.6 |
| pypi pycryptodome(PyPI) | = 3.0 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.0rc1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.2 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.2.1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.3 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.3.1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.11 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.3 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.4 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.5 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.6 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.7 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.8 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.4.9 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.5.0 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.5.1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.6.0 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.6.1 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.6.3 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.6.4 | No fix listed |
| pypi pycryptodome(PyPI) | = 3.6.5 | No fix listed |
| pycryptodome | < 3.6.6 | 3.6.6 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit issue-tracking third-party-advisory
- github.com product
- github.com vendor-advisory
- github.com
- whitehatck01.blogspot.com exploit technical-description third-party-advisory
- Debian Security Tracker CVE-2018-15560 vendor-advisory