PT-2012-4731 · Pycrypto+1 · Pycrypto+1

Vincent Danen · Published 2012-09-15 · Updated 2024-06-15 · CVE-2012-3458

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 1.6.4

Description The issue allows remote attackers to potentially obtain portions of sensitive session data. This is due to the use of AES in ECB cipher mode when PyCrypto is used to encrypt sessions.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-310

Related Identifiers

CVE-2012-3458

DSA-2541-1

GHSA-39VM-P9MR-4R27

OPENSUSE-SU-2024:10317-1

OPENSUSE-SU-2024:11203-1

OPENSUSE-SU-2024:13886-1

PYSEC-2012-1

Affected Products

Beaker

Pycrypto

References · 21

• https://cve.org/CVERecord?id=CVE-2012-3458 · Security Note
• https://osv.dev/vulnerability/GHSA-39vm-p9mr-4r27 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11203-1 · Vendor Advisory
• http://debian.org/security/2012/dsa-2541 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3458 · Vendor Advisory
• http://secunia.com/advisories/50520 · Vendor Advisory
• http://secunia.com/advisories/50226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3458 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3458 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3458 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-3458 · Vendor Advisory
• https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5 · Note
• https://github.com/bbangert/beaker · Note