CVE-2016-9243

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digestsize...

PT-2016-7715 · Python Cryptography Authority +2 · Cryptography +2

Name of the Vulnerable Software and Affected Versions: cryptography versions prior to 1.5.3 Description: The issue arises when HKDF in cryptography is used with a length less than algorithm.digest size, resulting in an empty byte-string being returned. Recommendations: For versions prior to 1.5.3...