debian/pycryptodome vulnerabilities

Latest debian/pycryptodome CVEs

Newest publication first

1. CVE-2023-52323 PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

   Published 2024-01-05

   Medium·CVSS 5.9 EPSS 0.62%

   PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

2. CVE-2018-15560 PyCryptodome integer overflow vulnerability

   Published 2018-08-20

   High·CVSS 7.5 EPSS 1.8%

   PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

3. CVE-2018-6594 Pycrypto generates weak key parameters

   Published 2018-02-03

   High·CVSS 7.5 EPSS 2.0%

   lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.