CVE-2018-15560: Integer Overflow
Published Aug 20, 2018
·Updated
PyCryptodome before 3.6.6 has an integer overflow in the datalen variable in AESNI.c, related to the AESNIencrypt and AESNIdecrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Affected Software
3 affected componentsFixes available
pip/pycryptodome<3.6.6
3.6.6
Python Pycryptodome<3.6.6
PyCryptodome PyCryptodome<3.6.6
Event History
Aug 20, 2018
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Aug 27, 2018
Advisory Published
via GitHub·07:52 PM
Frequently Asked Questions
1
What is the severity of CVE-2018-15560?
CVE-2018-15560 is classified as a medium severity vulnerability due to its potential impact on data integrity.
2
How do I fix CVE-2018-15560?
To fix CVE-2018-15560, upgrade to PyCryptodome version 3.6.6 or later.
3
What causes the vulnerability in CVE-2018-15560?
The vulnerability in CVE-2018-15560 is caused by an integer overflow in the data_len variable in the AESNI.c file.
4
Which software is affected by CVE-2018-15560?
CVE-2018-15560 affects all versions of PyCryptodome prior to 3.6.6.
5
What are the consequences of exploiting CVE-2018-15560?
Exploiting CVE-2018-15560 may lead to mishandling of messages shorter than 16 bytes, potentially allowing unauthorized access to sensitive data.