CVE-2012-2417 PyCrypto makes Use of Insufficiently Random Values
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pycrypto(PyPI) | < 2.6 | 2.6 |
| pypi pycrypto(PyPI) | = 1.9a2 | No fix listed |
| pypi pycrypto(PyPI) | = 1.9a5 | No fix listed |
| pypi pycrypto(PyPI) | = 1.9a6 | No fix listed |
| pypi pycrypto(PyPI) | = 2.0 | No fix listed |
| pypi pycrypto(PyPI) | = 2.0.1 | No fix listed |
| pypi pycrypto(PyPI) | = 2.1.0 | No fix listed |
| pypi pycrypto(PyPI) | = 2.2 | No fix listed |
| pypi pycrypto(PyPI) | = 2.3 | No fix listed |
| pypi pycrypto(PyPI) | = 2.4 | No fix listed |
| pypi pycrypto(PyPI) | = 2.4.1 | No fix listed |
| pypi pycrypto(PyPI) | = 2.5 | No fix listed |
| pypi pycrypto(PyPI) | = v2.3 | No fix listed |
| pypi pycrypto(PyPI) | = v2.2 | No fix listed |
| pypi pycrypto(PyPI) | = v2.1.0 | No fix listed |
| pypi pycrypto(PyPI) | = v2.1.0b1 | No fix listed |
| pypi pycrypto(PyPI) | = v2.1.0alpha2 | No fix listed |
| pypi pycrypto(PyPI) | = v2.1.0alpha1 | No fix listed |
| pypi pycrypto(PyPI) | = v1.9a5 | No fix listed |
| pypi pycrypto(PyPI) | = v1.9a4 | No fix listed |
| pypi pycrypto(PyPI) | = v1.9a3 | No fix listed |
| pypi pycrypto(PyPI) | = v1.9a2 | No fix listed |
| pypi pycrypto(PyPI) | = v1.9a1 | No fix listed |
| dlitz pycrypto | <= 2.5 | No fix listed |
| dlitz pycrypto | = 1.0.0 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| dlitz pycrypto | = 1.0.1 | No fix listed |
| dlitz pycrypto | = 1.0.2 | No fix listed |
| dlitz pycrypto | = 1.1-alpha2 | No fix listed |
| dlitz pycrypto | = 1.9-alpha1 | No fix listed |
| dlitz pycrypto | = 1.9-alpha2 | No fix listed |
| dlitz pycrypto | = 1.9-alpha3 | No fix listed |
| dlitz pycrypto | = 1.9-alpha4 | No fix listed |
| dlitz pycrypto | = 1.9-alpha5 | No fix listed |
| dlitz pycrypto | = 1.9-alpha6 | No fix listed |
| dlitz pycrypto | = 2.0 | No fix listed |
| dlitz pycrypto | = 2.0.1 | No fix listed |
| dlitz pycrypto | = 2.1.0 | No fix listed |
| dlitz pycrypto | = 2.1.0-alpha1 | No fix listed |
| dlitz pycrypto | = 2.1.0-alpha2 | No fix listed |
| dlitz pycrypto | = 2.1.0-beta1 | No fix listed |
| dlitz pycrypto | = 2.2 | No fix listed |
| dlitz pycrypto | = 2.3 | No fix listed |
| dlitz pycrypto | = 2.4 | No fix listed |
| dlitz pycrypto | = 2.4.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- bugs.launchpad.net
- pycrypto-keys-weak-security(75871) vdb-entry
- github.com product
- github.com
- github.com
- openSUSE-SU-2012:0830 vendor-advisory
- web.archive.org
- web.archive.org
- FEDORA-2012-8392 vendor-advisory
- FEDORA-2012-8490 vendor-advisory
- FEDORA-2012-8470 vendor-advisory
- DSA-2502 vendor-advisory
- MDVSA-2012:117 vendor-advisory
- [oss-security] 20120524 CVE-2012-2417 - PyCrypto <= 2.5 insecure ElGamal key generation mailing-list
- 49263 third-party-advisory vendor-advisory
- 82279 vdb-entry
- 53687 vdb-entry
- github.com vendor-advisory