CVE-2018-1000159

Source
https://nvd.nist.gov/vuln/detail/CVE-2018-1000159
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000159.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1000159
Aliases
Related
Published
2018-04-18T19:29:00Z
Modified
2025-01-14T07:19:50.502200Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad(); line "endpos = datalen - 1 - mac.digestsize" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.

References

Affected packages

Git / github.com/tomato42/tlslite-ng

Affected ranges

Type
GIT
Repo
https://github.com/tomato42/tlslite-ng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

Other

fork-start

v0.*

v0.3.9x
v0.4.1
v0.4.2
v0.4.3
v0.4.8
v0.5.0
v0.5.0-beta3
v0.5.0-beta4
v0.5.0-beta6
v0.5.1
v0.6.0
v0.6.0-alpha1
v0.6.0-alpha2
v0.6.0-alpha3
v0.6.0-alpha4
v0.6.0-alpha5
v0.6.0-beta1
v0.7.0
v0.7.0-alpha1
v0.7.0-alpha2
v0.7.0-alpha3
v0.7.0-alpha4
v0.7.0-alpha5
v0.7.0-alpha6
v0.7.0-alpha7
v0.7.0-alpha8
v0.7.0-alpha9
v0.7.0-beta1
v0.7.1
v0.7.2
v0.7.3