PYSEC-2017-8

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2017-8.yaml

JSON Data

https://api.test.osv.dev/v1/vulns/PYSEC-2017-8

Aliases

Published

2017-03-27T17:59:00Z

Modified

2023-11-01T04:47:14.781880Z

Summary

[none]

Details

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

References

Affected packages

PyPI / cryptography

Package

Name: cryptography; View open source insights on deps.dev
Purl: pkg:pypi/cryptography

Affected ranges

Type: GIT
Repo: https://github.com/pyca/cryptography
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b924696b2e8731f39696584d12cceeb3aeb2d874

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.3

Affected versions

0.*

0.1

0.2

0.2.1

0.2.2

0.3

0.4

0.5

0.5.1

0.5.2

0.5.3

0.5.4

0.6

0.6.1

0.7

0.7.1

0.7.2

0.8

0.8.1

0.8.2

0.9

0.9.1

0.9.2

0.9.3

1.*

1.0

1.0.1

1.0.2

1.1

1.1.1

1.1.2

1.2

1.2.1

1.2.2

1.2.3

1.3

1.3.1

1.3.2

1.3.3

1.3.4

1.4

1.5

1.5.1

1.5.2