PyCryptodome integer overflow vulnerability

ALTO 7.5CVE-2018-15560 · GHSA-hgg3-g7gr-66r7 · PYSEC-2018-21 · Published 20/08/2018 · updated 17/06/2026

In breve

CVE-2018-15560 è una vulnerabilità ALTO (CVSS 7.5) che riguarda pycryptodome, pycryptodome (pycryptodome).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.0% delle vulnerabilità.
Correzione: aggiornare a 3.6.6 o successiva.

Package	Affected versions	Patched versions
pycryptodome PyPI	`< 3.6.6`	`3.6.6`
pycryptodome pycryptodome	`< 3.6.6`	`3.6.6`

Description

PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-15560 · ADVISORY
Legrandin/pycryptodome · WEB
Legrandin/pycryptodome · PACKAGE
GitHub Advisory GHSA-hgg3-g7gr-66r7 · ADVISORY
pypa/advisory-database · WEB
whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html · WEB

Altre vulnerabilità di pycryptodome

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free