PT-2018-1902 · Python+1 · Pycrypto+1
Pghmcfc
·
Publicado
2018-02-03
·
Atualizado
2020-07-31
·
CVE-2018-6594
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
PyCrypto versions prior to 2.6.2
Python-crypto (affected versions not specified)
Description
The issue is related to the generation of weak key parameters in the ElGamal implementation. This allows a remote attacker to obtain sensitive information by reading encrypted data, as the implementation does not have semantic security against a ciphertext-only attack. The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Recommendations
For PyCrypto versions prior to 2.6.2, consider updating to a version that addresses the weak key parameter generation issue.
As a temporary workaround, consider restricting the use of the ElGamal key parameters generation function in lib/Crypto/PublicKey/ElGamal.py until a patch is available.
Exploit
Correção
Inadequate Encryption Strength
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Pycrypto
Ubuntu