PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the
    AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
    (CVE-2018-15560)

Security fix for CVE-2018-15560

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422453	SCA: security update for pycryptodome (GHSA-hgg3-g7gr-66r7)	Tenable Cloud Security	SCA Checks	high
422453	SCA: security update for pycryptodome (GHSA-hgg3-g7gr-66r7)	Tenable Self-Hosted Container Security	SCA Checks	high
400672	Alpine: py-pycryptodome: security update to 3.5.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400672	Alpine: py-pycryptodome: security update to 3.5.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
120612	Fedora 28 : python-pycryptodomex (2018-8fd21e2a72)	Nessus	Fedora Local Security Checks	high
120413	Fedora 29 : python-pycryptodomex (2018-4f06058324)	Nessus	Fedora Local Security Checks	high
117373	Fedora 27 : python-pycryptodomex (2018-a42eb4ac61)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-15560

high

Tenable Plugins

high

high

high

high

high

high

high