ISOMAN

CVE

CVE-2016-9243

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. http://www.openwall.com/lists/oss-security/2016/11/09/2
  2. http://www.securityfocus.com/bid/94216
  3. http://www.ubuntu.com/usn/USN-3138-1
  4. https://cryptography.io/en/latest/changelog
  5. https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874
  6. https://github.com/pyca/cryptography/issues/3211
  7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL/
  8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U23KDR2M2N7W2ZSREG63BVW7D4VC6CIZ/
  9. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQ5G7KHKZC4SI23JE7277KZXM57GEQKT/
  10. http://www.openwall.com/lists/oss-security/2016/11/09/2
  11. http://www.securityfocus.com/bid/94216
  12. http://www.ubuntu.com/usn/USN-3138-1
  13. https://cryptography.io/en/latest/changelog
  14. https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874
  15. https://github.com/pyca/cryptography/issues/3211
  16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL/
  17. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U23KDR2M2N7W2ZSREG63BVW7D4VC6CIZ/
  18. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQ5G7KHKZC4SI23JE7277KZXM57GEQKT/