CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2018-1000159
Medium (5.9) in tlslite-ng project tlslite-ng. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in tlslite-ng 0.7.4.
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-354
- Published
- Modified
- Record from
- the NVD, synced
Affected
- tlslite-ng_project:tlslite-ng
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cwh5-3cw7-4286 | PyPI | tlslite-ng | <0.7.4 | 0.7.4 |
| PYSEC-2018-31 | PyPI | tlslite-ng | <0.7.4 | 0.7.4 |