CVE-2018-1000159: tlslite-ng_project tlslite-ng
Vulnerability summary
CVE-2018-1000159 is a medium (CVSS 5.9) vulnerability in tlslite-ng_project tlslite-ng. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 55.7% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 18-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.77% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
PyPI1 product
- tlslite-ng< 0.7.4
Tlslite-ng_project1 product
- tlslite-ng≤ 0.7.3
Ubuntu1 product
- tlslite-ngAll versions (No fix recorded)
3 vendors · 3 products
