HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py-cryptography. | Aug 30, 2017 | Mar 27, 2017 |
| Debian | — | Upgrade python-cryptography | Jul 30, 2024 | Mar 27, 2017 |
| Freebsd | — | Upgrade py34-cryptographyUpgrade py35-cryptographyUpgrade py33-cryptographyUpgrade py27-cryptography | Dec 4, 2016 | Dec 4, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-cryptography | Sep 16, 2021 | Mar 27, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python2-cryptography | Apr 30, 2021 | Mar 27, 2017 |
| Oracle Solaris | — | Upgrade library/python/cryptography to version 1.7.2-0.175.3.21.0.4.0 on Solaris 11.3Upgrade library/python/cryptography-34 to version 1.7.2-0.175.3.21.0.4.0 on Solaris 11.3Upgrade library/python/cryptography-27 to version 1.7.2-0.175.3.21.0.4.0 on Solaris 11.3 | Jun 20, 2017 | Mar 27, 2017 |
| Ubuntu | — | Upgrade python-cryptographyUpgrade python3-cryptography | Nov 28, 2016 | Nov 28, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub