medium
5.3
CWE
310
Advisory Published
Advisory Published
Updated

CVE-2012-2417

First published: Sun Jun 17 2012(Updated: )

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
pip/PyCrypto<2.6
2.6
SUSE Python-pycrypto<=2.5
SUSE Python-pycrypto=1.0.0
SUSE Python-pycrypto=1.0.1
SUSE Python-pycrypto=1.0.2
SUSE Python-pycrypto=1.1-alpha2
SUSE Python-pycrypto=1.9-alpha1
SUSE Python-pycrypto=1.9-alpha2
SUSE Python-pycrypto=1.9-alpha3
SUSE Python-pycrypto=1.9-alpha4
SUSE Python-pycrypto=1.9-alpha5
SUSE Python-pycrypto=1.9-alpha6
SUSE Python-pycrypto=2.0
SUSE Python-pycrypto=2.0.1
SUSE Python-pycrypto=2.1.0
SUSE Python-pycrypto=2.1.0-alpha1
SUSE Python-pycrypto=2.1.0-alpha2
SUSE Python-pycrypto=2.1.0-beta1
SUSE Python-pycrypto=2.2
SUSE Python-pycrypto=2.3
SUSE Python-pycrypto=2.4
SUSE Python-pycrypto=2.4.1

Remedy

https://github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2012-2417?

    CVE-2012-2417 is considered to have a medium severity due to its potential to enable brute force attacks on generated keys.

  • How do I fix CVE-2012-2417?

    To fix CVE-2012-2417, upgrade to PyCrypto version 2.6 or later.

  • Which versions of PyCrypto are affected by CVE-2012-2417?

    CVE-2012-2417 affects all versions of PyCrypto prior to 2.6.

  • What is the impact of CVE-2012-2417?

    The impact of CVE-2012-2417 is the potential compromise of private keys due to inadequate prime number generation.

  • Can CVE-2012-2417 lead to data breaches?

    Yes, CVE-2012-2417 can lead to data breaches if attackers successfully obtain the private key through brute force methods.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203