CVE-2013-1445: Vulnerability in PyCrypto allows sensitive information leakage
Summary
CVE-2013-1445: The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent atta... Affects pycrypto across 2 version ranges.
< 2.6.1
< 19dcf7b15d61b7dc1a125a367151de40df6ef175
Fixed in 19dcf7b15d61b7dc1a125a367151de40df6ef175. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyCrypto is a Python library that provides cryptographic services such as encryption, decryption, and random number generation. It is widely used in various applications to ensure data security. However, a vulnerability has been discovered in PyCrypto versions before 2.6.1 that can lead to the leakage of sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2013-1445, stems from the Crypto.Random.atfork function in PyCrypto. This function fails to properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it. This oversight creates a race condition where a child process can access the PRNG within the same rate-limit period as another process. An attacker can exploit this race condition to obtain sensitive information, potentially compromising the security of the system.
How To Fix
Latest published version: 2.6.1 as of 22 Oct 2026
pip install --upgrade "pycrypto==2.6.1"The newest release already contains this fix.
If you need the minimum change
19dcf7b15d61b7dc1a125a367151de40df6ef175
This is the first release that contains the fix.
pip install --upgrade "pycrypto==19dcf7b15d61b7dc1a125a367151de40df6ef175"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating PyCrypto is not immediately feasible, a possible workaround is to avoid using the Crypto.Random.atfork function in applications that rely on PyCrypto. By avoiding the use of this function, the race condition can be mitigated. However, it is still strongly advised to update to the latest version of PyCrypto as soon as possible.
Conclusion
The vulnerability in PyCrypto versions before 2.6.1 can lead to the leakage of sensitive information due to a race condition in the Crypto.Random.atfork function. It is crucial to update PyCrypto to the latest version to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pycrypto →
FAQ
PyCrypto is a Python library that provides cryptographic services such as encryption, decryption, and random number generation.
This vulnerability allows context-dependent attackers to obtain sensitive information by exploiting a race condition in PyCrypto. The compromised information can potentially be used to compromise the security of the system.
To fix this vulnerability, update PyCrypto to version 2.6.1 or later by running the command 'pip install --upgrade pycrypto'.
If updating PyCrypto is not immediately feasible, you can mitigate the vulnerability by avoiding the use of the Crypto.Random.atfork function in your applications.
You can find more information about this vulnerability in the PyCrypto advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pycrypto/PYSEC-2013-29.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pycrypto.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
