lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
rzr
commented
4 years ago
CVE-2018-6594 - High Severity Vulnerability
Cryptographic modules for Python.
Library home page: https://files.pythonhosted.org/packages/60/db/645aa9af249f059cc3a368b118de33889219e0362141e75d4eaf6f80f163/pycrypto-2.6.1.tar.gz
Path to dependency file: /tmp/ws-scm/awox-mesh-light-webthing/requirements.txt
Path to vulnerable library: /tmp/ws-scm/awox-mesh-light-webthing/requirements.txt
Dependency Hierarchy: - awoxmeshlight (Root Library) - :x: **pycrypto-2.6.1.tar.gz** (Vulnerable Library)
Found in HEAD commit: 858eac55dab133db6957ec0e6aa4e32e2171676c
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Publish Date: 2018-02-03
URL: CVE-2018-6594
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with WhiteSource here