CVE-2016-9243: Input Validation
Published Mar 27, 2017
·Updated
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digestsize.
Other sources
HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digestsize.
— GitHub
Affected Software
8 affected componentsFixes available
pip/cryptography<1.5.3
1.5.3
Cryptography.io Cryptography Python<=1.5.2
Fedoraproject Fedora=23
Fedoraproject Fedora=24
Fedoraproject Fedora=25
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=16.10
Cryptography.io Cryptography<=1.5.2
Remediation
Patch Available
Event History
Mar 27, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
RemedyDescriptionSeverityAffected Software
May 17, 2022
Advisory Published
via GitHub·02:51 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-9243?
CVE-2016-9243 is considered to be of moderate severity due to the impact on cryptographic integrity when using HKDF.
2
How do I fix CVE-2016-9243?
To fix CVE-2016-9243, update the cryptography library to version 1.5.3 or later.
3
Which versions of cryptography are affected by CVE-2016-9243?
CVE-2016-9243 affects all versions of the cryptography library prior to 1.5.3.
4
What kind of software is impacted by CVE-2016-9243?
CVE-2016-9243 impacts software that relies on the cryptography library for HKDF implementations.
5
Is there a workaround for CVE-2016-9243 before applying updates?
There is no known workaround; the best approach is to update to the fixed version.