Lucene search

RedhatCVE-2016-9243

HistoryMar 27, 2017 - 5:59 p.m.

CVE-2016-9243

2017-03-2717:59:00

redhat

web.nvd.nist.gov

118

cve-2016-9243

cryptography

hkdf

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

Affected configurations

Nvd

Node

cryptography.iocryptographyRange≤1.5.2python

Node

fedoraprojectfedoraMatch23

fedoraprojectfedoraMatch24

fedoraprojectfedoraMatch25

Node

canonicalubuntu_linuxMatch16.04lts

canonicalubuntu_linuxMatch16.10

VendorProductVersionCPE
cryptography.iocryptography*cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*
fedoraprojectfedora23cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
fedoraprojectfedora24cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
fedoraprojectfedora25cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonicalubuntu_linux16.10cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cryptography.io	cryptography	*	cpe:2.3:a:cryptography.io:cryptography::::::python::*
fedoraproject	fedora	23	cpe:2.3:o:fedoraproject:fedora:23:::::::*
fedoraproject	fedora	24	cpe:2.3:o:fedoraproject:fedora:24:::::::*
fedoraproject	fedora	25	cpe:2.3:o:fedoraproject:fedora:25:::::::*
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
canonical	ubuntu_linux	16.10	cpe:2.3:o:canonical:ubuntu_linux:16.10:::::::*