tlslite-ng off-by-one error on mac checking
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line end_pos = data_len - 1 - mac.digest_size that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | tlslite-ng | < 0.7.4 | 0.7.4 |
References
- https://github.com/tomato42/tlslite-ng/pull/234
- https://github.com/advisories/GHSA-cwh5-3cw7-4286
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000159
- https://github.com/tlsfuzzer/tlslite-ng/pull/234/commits/3674815d1b0f7484454995e2737a352e0a6a93d8
- https://github.com/tlsfuzzer/tlslite-ng/commit/d7b288316bca7bcdd082e6ccff5491e241305233
- https://github.com/pypa/advisory-database/tree/main/vulns/tlslite-ng/PYSEC-2018-31.yaml
- https://github.com/tomato42/tlslite-ng
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-354- Platform
- Python (PyPI)
- Package
tlslite-ng- Disclosed
- 18.04.2018
- Updated
- 11.10.2026 11:20
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2018-31 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-cwh5-3cw7-4286 - CC BY 4.0
Vulnerability history: tlslite-ng
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2018 12.2020
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
tlslite-ng off-by-one error on mac checking this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.