PT-2018-1902 · Python+1 · Pycrypto+1

Pghmcfc · Published 2018-02-03 · Updated 2020-07-31 · CVE-2018-6594

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyCrypto versions prior to 2.6.2 Python-crypto (affected versions not specified)

Description The issue is related to the generation of weak key parameters in the ElGamal implementation. This allows a remote attacker to obtain sensitive information by reading encrypted data, as the implementation does not have semantic security against a ciphertext-only attack. The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.

Recommendations For PyCrypto versions prior to 2.6.2, consider updating to a version that addresses the weak key parameter generation issue. As a temporary workaround, consider restricting the use of the ElGamal key parameters generation function in lib/Crypto/PublicKey/ElGamal.py until a patch is available.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-310

CWE-326

Related Identifiers

BDU:2018-01506

CVE-2018-6594

GHSA-6528-WVF6-F6QG

MGASA-2018-0171

PYSEC-2018-97

USN-3616-1

USN-3616-2

Affected Products

Pycrypto

Ubuntu

References · 27

• 🔥 https://github.com/dlitz/pycrypto/issues/253 · Exploit
• https://usn.ubuntu.com/3616-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6594 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0171 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-62 · Vendor Advisory
• https://usn.ubuntu.com/3616-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6594 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3616-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-97 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01506 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-6594 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6594 · Security Note
• https://ubuntu.com/security/notices/USN-3616-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6594 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3616-1 · Vendor Advisory