Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-6gxf-2bj4-1qew

Summary PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.

Aliases

alias	CVE-2018-15560

alias	GHSA-hgg3-g7gr-66r7

alias	PYSEC-2018-21

Fixed_packages

url	pkg:deb/debian/pycryptodome@0?distro=trixie
purl	pkg:deb/debian/pycryptodome@0?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/pycryptodome@0%3Fdistro=trixie

url pkg:deb/debian/pycryptodome@3.9.7%2Bdfsg1-1?distro=trixie

purl pkg:deb/debian/pycryptodome@3.9.7%2Bdfsg1-1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/pycryptodome@3.9.7%252Bdfsg1-1%3Fdistro=trixie

url pkg:deb/debian/pycryptodome@3.11.0%2Bdfsg1-4?distro=trixie

purl pkg:deb/debian/pycryptodome@3.11.0%2Bdfsg1-4?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/pycryptodome@3.11.0%252Bdfsg1-4%3Fdistro=trixie

url	pkg:deb/debian/pycryptodome@3.20.0%2Bdfsg-3?distro=trixie
purl	pkg:deb/debian/pycryptodome@3.20.0%2Bdfsg-3?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/pycryptodome@3.20.0%252Bdfsg-3%3Fdistro=trixie

url pkg:pypi/pycryptodome@3.6.6

purl pkg:pypi/pycryptodome@3.6.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.6

Affected_packages

url pkg:pypi/pycryptodome@3.0rc1

purl pkg:pypi/pycryptodome@3.0rc1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.0rc1

url pkg:pypi/pycryptodome@3.0

purl pkg:pypi/pycryptodome@3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.0

url pkg:pypi/pycryptodome@3.1

purl pkg:pypi/pycryptodome@3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.1

url pkg:pypi/pycryptodome@3.2

purl pkg:pypi/pycryptodome@3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.2

url pkg:pypi/pycryptodome@3.2.1

purl pkg:pypi/pycryptodome@3.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.2.1

url pkg:pypi/pycryptodome@3.3

purl pkg:pypi/pycryptodome@3.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.3

url pkg:pypi/pycryptodome@3.3.1

purl pkg:pypi/pycryptodome@3.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.3.1

url pkg:pypi/pycryptodome@3.4

purl pkg:pypi/pycryptodome@3.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4

url pkg:pypi/pycryptodome@3.4.3

purl pkg:pypi/pycryptodome@3.4.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.3

url pkg:pypi/pycryptodome@3.4.4

purl pkg:pypi/pycryptodome@3.4.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.4

url pkg:pypi/pycryptodome@3.4.5

purl pkg:pypi/pycryptodome@3.4.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.5

url pkg:pypi/pycryptodome@3.4.6

purl pkg:pypi/pycryptodome@3.4.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.6

url pkg:pypi/pycryptodome@3.4.7

purl pkg:pypi/pycryptodome@3.4.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.7

url pkg:pypi/pycryptodome@3.4.8

purl pkg:pypi/pycryptodome@3.4.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.8

url pkg:pypi/pycryptodome@3.4.9

purl pkg:pypi/pycryptodome@3.4.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.9

url pkg:pypi/pycryptodome@3.4.11

purl pkg:pypi/pycryptodome@3.4.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.4.11

url pkg:pypi/pycryptodome@3.5.0

purl pkg:pypi/pycryptodome@3.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.5.0

url pkg:pypi/pycryptodome@3.5.1

purl pkg:pypi/pycryptodome@3.5.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.5.1

url pkg:pypi/pycryptodome@3.6.0

purl pkg:pypi/pycryptodome@3.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.0

url pkg:pypi/pycryptodome@3.6.1

purl pkg:pypi/pycryptodome@3.6.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.1

url pkg:pypi/pycryptodome@3.6.3

purl pkg:pypi/pycryptodome@3.6.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.3

url pkg:pypi/pycryptodome@3.6.4

purl pkg:pypi/pycryptodome@3.6.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.4

url pkg:pypi/pycryptodome@3.6.5

purl pkg:pypi/pycryptodome@3.6.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6gxf-2bj4-1qew

vulnerability	VCID-xyku-dd6j-u3ex

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/pycryptodome@3.6.5

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2018-15560

reference_id

reference_type

scores

value	0.00328
scoring_system	epss
scoring_elements	0.55696
published_at	2026-04-07T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55742
published_at	2026-04-21T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55763
published_at	2026-04-18T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55721
published_at	2026-04-13T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55739
published_at	2026-04-12T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55759
published_at	2026-04-16T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.5575
published_at	2026-04-09T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55583
published_at	2026-04-01T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55747
published_at	2026-04-08T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55695
published_at	2026-04-02T12:55:00Z

value	0.00328
scoring_system	epss
scoring_elements	0.55718
published_at	2026-04-04T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2018-15560

reference_url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_id

reference_type

scores

value	5.1
scoring_system	cvssv3
scoring_elements	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_url

https://github.com/advisories/GHSA-hgg3-g7gr-66r7

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/advisories/GHSA-hgg3-g7gr-66r7

reference_url

https://github.com/Legrandin/pycryptodome

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/Legrandin/pycryptodome

reference_url

https://github.com/Legrandin/pycryptodome/issues/198

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/Legrandin/pycryptodome/issues/198

reference_url

https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodome/PYSEC-2018-21.yaml

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodome/PYSEC-2018-21.yaml

reference_url

https://whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2018-15560

reference_id

CVE-2018-15560

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	8.7
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2018-15560

Weaknesses

cwe_id	190
name	Integer Overflow or Wraparound
description	The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 5.1 - 8.9

Exploitability 0.5

Weighted_severity 8.0

Risk_score 4.0

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6gxf-2bj4-1qew

Vulnerability Instance