CVE-2018-15560 PyCryptodome integer overflow vulnerability
An integer overflow in PyCryptodome mishandles short messages, potentially causing incorrect encryption or decryption behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-15560?
CVE-2018-15560 is a high-severity vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Weakness: CWE-190
Which versions are affected by CVE-2018-15560?
3 open source packages ship an affected version, including pycryptodome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pycryptodome PyPI | All versions | 3.6.6 |
pycryptodome PyPI | All versions | 3.6.6 |
pycryptodome PyPI | All versions | 3.6.6 |
Products include Pycryptodome Pycryptodome.
How do I fix CVE-2018-15560?
Upgrade pycryptodome to 3.6.6 or later.
Is CVE-2018-15560 being exploited?
There is no known exploitation of CVE-2018-15560 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hgg3-g7gr-66r7, PYSEC-2018-21.