Every CVESearch/Get API key

CVE-2008-2316

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow...

7.5 High

CVE-2008-2316 is a high vulnerability (CVSS 7.5) in Python, published August 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.09%, the 90th percentile. No source names a fixed version.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
4.09%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Exploit likelihood

4.09%Up 1.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-py
Azure Linux:3
through 1.11.0-1None known
python2.4
Debian:4.0
From an advisory covering 3 CVEs
before 2.4.4-3+etch3, plus listed versions
2.4.4-32.4.4-3+etch12.4.4-3+etch2
2.4.4-3+etch3
python2.5
Debian:4.0
From an advisory covering 3 CVEs
before 2.5-5+etch2, plus listed versions
2.5-52.5-5+etch1
2.5-5+etch2
python2.4
Debian:5.0
From an advisory covering 3 CVEs
before 2.4.6-1+lenny1, plus listed versions
2.4.6-1
2.4.6-1+lenny1
python2.5
Debian:5.0
From an advisory covering 3 CVEs
before 2.5.2-15+lenny1, plus listed versions
2.5.2-15
2.5.2-15+lenny1
python2.5
Debian:5.0
From an advisory covering 4 CVEs
before 2.5.2-6+lenny1
2.5.2-6+lenny1
python
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
python
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
python
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python
SUSE:Linux Enterprise Module for Python 2 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Python 2 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
python
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
before 2.7.18-8.1
2.7.18-8.1

What each source reports

NVD Score used7.5

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
CVE-2008-2316
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE ListNo score

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
CVE-2008-2316
Updated
2026-11-02
EUVDEUVD-2008-2312No score

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
EUVD-2008-2312
Updated
2026-11-03
GitHub AdvisoriesGHSA-482h-xg25-ghqhNo score

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow...

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
GHSA-482h-xg25-ghqh
Updated
2026-11-02
OSVAZL-109569No score

CVE-2008-2316 affecting package python-py 1.11.0-1

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
AZL-109569
Updated
2026-11-02
OSVopenSUSE-SU-2024:11202-1No score

python-2.7.18-8.1 on GA media

These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11202-1
Updated
2026-11-02
OSVPSF-2008-5No score

Multiple integer overflows (Apple)

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

Record
PSF-2008-5
Updated
2026-11-02
OSVSUSE-SU-2020:0234-1No score

Security update for python

This update for python fixes the following issues:

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Record
SUSE-SU-2020:0234-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 152 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open