CVE-2012-2417: Medium severity suse python-pycrypto vulnerability
Published Jun 17, 2012
·Updated
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
Affected Software
22 affected componentsFixes available
pip/PyCrypto<2.6
2.6
dlitz pycrypto<=2.5
dlitz pycrypto=1.0.0
dlitz pycrypto=1.0.1
dlitz pycrypto=1.0.2
dlitz pycrypto=1.1-alpha2
dlitz pycrypto=1.9-alpha1
dlitz pycrypto=1.9-alpha2
dlitz pycrypto=1.9-alpha3
dlitz pycrypto=1.9-alpha4
dlitz pycrypto=1.9-alpha5
dlitz pycrypto=1.9-alpha6
dlitz pycrypto=2.0
dlitz pycrypto=2.0.1
dlitz pycrypto=2.1.0
dlitz pycrypto=2.1.0-alpha1
dlitz pycrypto=2.1.0-alpha2
dlitz pycrypto=2.1.0-beta1
dlitz pycrypto=2.2
dlitz pycrypto=2.3
dlitz pycrypto=2.4
dlitz pycrypto=2.4.1
Remediation
Event History
Jun 17, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
May 17, 2022
Advisory Published
via GitHub·01:46 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-2417?
CVE-2012-2417 is considered to have a medium severity due to its potential to enable brute force attacks on generated keys.
2
How do I fix CVE-2012-2417?
To fix CVE-2012-2417, upgrade to PyCrypto version 2.6 or later.
3
Which versions of PyCrypto are affected by CVE-2012-2417?
CVE-2012-2417 affects all versions of PyCrypto prior to 2.6.
4
What is the impact of CVE-2012-2417?
The impact of CVE-2012-2417 is the potential compromise of private keys due to inadequate prime number generation.
5
Can CVE-2012-2417 lead to data breaches?
Yes, CVE-2012-2417 can lead to data breaches if attackers successfully obtain the private key through brute force methods.