logo

Database

Out-of-bounds read In pycryptodome

Description

PyCryptodome integer overflow vulnerability PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2018-155602. NVD-2018-155603. OSV-2018-155604. GHSA-hgg3-g7gr-66r75. GCVE-2018-15560

References

1. https://github.com/Legrandin/pycryptodome/issues/1982. https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodome/PYSEC-2018-21.yaml3. https://whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.