PT-2012-4028 · Pycrypto+1 · Pycrypto+1

Gooksankoo + 1 · Published 2012-06-17 · Updated 2022-05-17 · CVE-2012-2417

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyCrypto versions prior to 2.6

Description The issue concerns the generation of prime numbers when using an ElGamal scheme to create a key. This results in a reduced signature space or public key space, making it easier for attackers to perform brute force attacks to obtain the private key.

Recommendations For versions prior to 2.6, update to version 2.6 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-2417

DSA-2502-1

GHSA-V367-P58W-98H5

PYSEC-2012-16

SUSE-SU-2012_0869-1

Affected Products

Pycrypto

Suse

References · 27

• 🔥 https://github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2 · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2012:117 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html · Vendor Advisory
• http://secunia.com/advisories/49263 · Vendor Advisory
• https://hermes.opensuse.org/messages/15083589 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-16 · Vendor Advisory
• http://debian.org/security/2012/dsa-2502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2417 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081789.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2417 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081759.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v367-p58w-98h5 · Vendor Advisory
• https://github.com/dlitz/pycrypto/blob/373ea760f21701b162e8c4912a66928ee30d401a/ChangeLog · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2012-16.yaml · Note
• https://github.com/Legrandin/pycrypto · Note