CVE-2016-9243

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

Date published : 2017-03-27

http://www.securityfocus.com/bid/94216

https://cryptography.io/en/latest/changelog