CVE-2012-2417
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dlitz:pycrypto
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v367-p58w-98h5 | PyPI | pycrypto | <2.6 | 2.6 |
| PYSEC-2012-16 | PyPI | pycrypto | <2.6 | 2.6 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081759.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081789.html
- http://secunia.com/advisories/49263
- http://www.debian.org/security/2012/dsa-2502