GHSA-cwh5-3cw7-4286

Suggest an improvement
Source
https://github.com/advisories/GHSA-cwh5-3cw7-4286
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-cwh5-3cw7-4286/GHSA-cwh5-3cw7-4286.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cwh5-3cw7-4286
Aliases
Published
2018-07-12T20:30:44Z
Modified
2024-11-24T05:38:43.510229Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
tlslite-ng off-by-one error on mac checking
Details

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line end_pos = data_len - 1 - mac.digest_size that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.

Database specific 
{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:33:04Z",
    "cwe_ids": [
        "CWE-354"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

PyPI / tlslite-ng

Package

Name
tlslite-ng
View open source insights on deps.dev
Purl
pkg:pypi/tlslite-ng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.4

Affected versions

0.*

0.5.0-beta1
0.5.0-beta2
0.5.0-beta3
0.5.0-beta4
0.5.0-beta5
0.5.0-beta6
0.5.0
0.5.1
0.5.2
0.6.0-alpha1
0.6.0-alpha2
0.6.0-alpha3
0.6.0-alpha4
0.6.0-alpha5
0.6.0-beta1
0.6.0
0.7.0-alpha1
0.7.0-alpha2
0.7.0-alpha3
0.7.0-alpha4
0.7.0-alpha5
0.7.0-alpha6
0.7.0-alpha7
0.7.0-alpha8
0.7.0-alpha9
0.7.0-beta1
0.7.0
0.7.1
0.7.2
0.7.3