GitHub Advisoryadvisory · PyPI

GHSA-6528-wvf6-f6qg Pycrypto generates weak key parameters

HIGH Published 2018-07-12 Modified 2024-10-18 Official page ↗
Aliases
CVE-2018-6594
Ecosystem
PyPI
Packages
pycrypto
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326
Reviewed
2020-06-16

Affected packages

• PyPI pycrypto: <= 2.6.1 (no fix yet)

Description

lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.

Related

Alias · CVE (1)

  • CVE-2018-6594 lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References