CVE-2012-2417: PyCrypto makes Use of Insufficiently Random Values
(updated )
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
References
- bugs.launchpad.net/pycrypto/+bug/985164
- exchange.xforce.ibmcloud.com/vulnerabilities/75871
- github.com/Legrandin/pycrypto
- github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2
- github.com/advisories/GHSA-v367-p58w-98h5
- github.com/dlitz/pycrypto/blob/373ea760f21701b162e8c4912a66928ee30d401a/ChangeLog
- github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2012-16.yaml
- hermes.opensuse.org/messages/15083589
- nvd.nist.gov/vuln/detail/CVE-2012-2417
- web.archive.org/web/20140724111917/http://secunia.com/advisories/49263
- web.archive.org/web/20200228184120/http://www.securityfocus.com/bid/53687
Code Behaviors & Features
Detect and mitigate CVE-2012-2417 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →