{"action":"Upgrade pycryptodome to 3.6.6 or later.","affected":[{"fixed":"3.6.6","introduced":"0"}],"component":"pycryptodome","cve_ids":["CVE-2018-15560"],"ecosystem":"PyPI","epss":0.01756,"exploited":false,"fixed_versions":["3.6.6"],"ghsa_id":"GHSA-hgg3-g7gr-66r7","id":"tcs_01M5KG7VMY4SY002XMR0XWPW3T","modified_at":"2023-11-08T03:59:57.665352Z","published_at":"2018-08-20T00:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-21","https://whitehatck01.blogspot.com/2018/08/integer-overflow-vulnerability-in.html","https://github.com/Legrandin/pycryptodome/issues/198","https://github.com/advisories/GHSA-hgg3-g7gr-66r7"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-21","url":"https://osv.dev/vulnerability/PYSEC-2018-21"}],"summary":"PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16"}