PT-2012-4028 · Pycrypto+1 · Pycrypto+1

Gooksankoo + 1 · Publicado 2012-06-17 · Atualizado 2022-05-17 · CVE-2012-2417

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyCrypto versions prior to 2.6

Description The issue concerns the generation of prime numbers when using an ElGamal scheme to create a key. This results in a reduced signature space or public key space, making it easier for attackers to perform brute force attacks to obtain the private key.

Recommendations For versions prior to 2.6, update to version 2.6 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-2417

DSA-2502-1

GHSA-V367-P58W-98H5

PYSEC-2012-16

SUSE-SU-2012_0869-1

Produtos afetados

Pycrypto

Suse

Referências · 27

• 🔥 https://github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2 · Exploit
• https://github.com/dlitz/pycrypto/blob/373ea760f21701b162e8c4912a66928ee30d401a/ChangeLog · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2012-16.yaml · Nota
• https://github.com/Legrandin/pycrypto · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2012:117 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/05/25/1 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html · Aviso do Fabricante
• http://secunia.com/advisories/49263 · Aviso do Fabricante
• https://hermes.opensuse.org/messages/15083589 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-16 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2502 · Aviso do Fabricante
• http://securityfocus.com/bid/53687 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2012-July/000177.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2417 · Nota de Segurança