CVE-2016-9243

CVE-2016-9243 describes a vulnerability in the HKDF implementation within the cryptography library (versions prior to 1.5.2), where requesting a derived key length less than the algorithm's digest_size results in an empty byte-string. This flaw impacts various distributions including Canonical, Fedora, and cryptography.io. Rated with a CVSS score of 7.5 (HIGH), it presents a network-based attack vector with low complexity, potentially leading to high integrity impacts by compromising cryptographic operations. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.