GitHub Advisoryadvisory · PyPI

GHSA-q3cj-2r34-2cwc Improper input validation in cryptography

HIGH Published 2022-05-17 Modified 2024-09-13 Official page ↗
Aliases
CVE-2016-9243
Ecosystem
PyPI
Packages
cryptography
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-06-17

Affected packages

• PyPI cryptography: < 1.5.3 → fixed in 1.5.3

Description

HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digest_size.

Related

Alias · CVE (1)

  • CVE-2016-9243 HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References