pycryptodome vulnerabilities

Products

• pycryptodome 2
• pycryptodomex 1

Latest pycryptodome CVEs

Newest publication first

1. CVE-2023-52323 PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

   Published 2024-01-05

   Medium·CVSS 5.9 EPSS 0.62%

   PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

2. CVE-2018-15560 PyCryptodome integer overflow vulnerability

   Published 2018-08-20

   High·CVSS 7.5 EPSS 1.8%

   PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.