1. CVE-Search
  2. CVE-2016-9243
ID CVE-2016-9243
Summary HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
References
Vulnerable Configurations
  • cpe:2.3:a:cryptography.io:cryptography:0.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.2.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.2.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.2.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.2.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.4:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.4:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.5:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.5:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.5.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.5.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.5.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.5.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.5.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.5.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.5.4:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.5.4:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.6:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.6:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.6.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.6.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.7:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.7:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.7.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.7.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.7.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.7.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.8:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.8:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.8.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.8.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.8.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.8.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.9:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.9:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.9.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.9.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.9.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.9.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:0.9.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:0.9.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.0:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.0:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.0.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.0.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.0.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.0.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.1.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.1.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.1.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.1.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.2.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.2.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.2.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.2.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.2.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.2.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.3.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.3.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.3.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.3.2:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.3.3:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.3.3:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.3.4:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.3.4:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.4:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.4:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.5:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.5:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.5.1:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.5.1:*:*:*:*:python:*:*
  • cpe:2.3:a:cryptography.io:cryptography:1.5.2:*:*:*:*:python:*:*
    cpe:2.3:a:cryptography.io:cryptography:1.5.2:*:*:*:*:python:*:*
  • cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
CVSS
Base: 5.0 (as of 09-09-2024 - 13:52)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
bid 94216
confirm
fedora
  • FEDORA-2016-2d90e27e50
  • FEDORA-2016-d3a2b640ce
  • FEDORA-2016-e77c8c1f3b
mlist [oss-security] 20161109 Re: CVE Request: Cryptography 1.5.3: HKDF might return an empty byte-string
ubuntu USN-3138-1
Last major update 09-09-2024 - 13:52
Published 27-03-2017 - 17:59
Last modified 09-09-2024 - 13:52
Back to Top