Fluid Attacks Database

Description

Improper input validation in cryptography HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digest_size.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	cryptography	>=0 <1.5.3	1.5.3
debian 11	python-cryptography	>=0 <1.5.3-1	1.5.3-1
debian 14	python-cryptography	>=0 <1.5.3-1	1.5.3-1
debian 13	python-cryptography	>=0 <1.5.3-1	1.5.3-1
debian 12	python-cryptography	>=0 <1.5.3-1	1.5.3-1

Aliases

1. CVE-2016-92432. NVD-2016-92433. OSV-2016-92434. OSV-DEBIAN-2016-92435. GHSA-q3cj-2r34-2cwc6. GCVE-2016-92437. SECURITY-TRACKER-CVE-2016-9243

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.