CVE-2013-1445: Race Condition
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1445?
CVE-2013-1445 has a medium severity rating due to the potential for sensitive information leakage.
How do I fix CVE-2013-1445?
To mitigate CVE-2013-1445, upgrade PyCrypto to version 2.6.1 or later.
What software versions are affected by CVE-2013-1445?
CVE-2013-1445 affects all versions of PyCrypto prior to 2.6.1.
What is the impact of CVE-2013-1445?
The impact of CVE-2013-1445 involves easier access for attackers to obtain sensitive information due to a race condition.
Is there a patch available for CVE-2013-1445?
Yes, a patch is available as part of PyCrypto version 2.6.1, which resolves the vulnerability.