CVE-2013-7459: Heap-based buffer overflow in Python Cryptography Toolkit (pycrypto)
Summary
CVE-2013-7459: Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.... Affects pycrypto versions < 8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4. Fixed in 8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python Cryptography Toolkit (pycrypto) is a library for cryptographic algorithms and protocols in Python. It provides various cryptographic services, including encryption, decryption, hashing, and random number generation. The vulnerability in pycrypto is a heap-based buffer overflow in the ALGnew function in block_templace.c. This vulnerability allows remote attackers to execute arbitrary code by exploiting a crafted iv parameter in the cryptmsg.py script.
Vulnerability Detail
The vulnerability in pycrypto arises from a heap-based buffer overflow in the ALGnew function. This function is responsible for creating a new algorithm object for block ciphers. By providing a specially crafted iv parameter to the cryptmsg.py script, an attacker can trigger the buffer overflow and potentially execute arbitrary code on the target system. This can lead to various consequences, including remote code execution, privilege escalation, and information disclosure.
How To Fix
Latest published version: 2.6.1 as of 22 Oct 2026
pip install --upgrade "pycrypto==2.6.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4
This is the first release that contains the fix.
pip install --upgrade "pycrypto==8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to ensure that the pycrypto library is kept up to date with the latest security patches and updates. Additionally, users should exercise caution when processing untrusted input and avoid using vulnerable versions of pycrypto in critical systems.
Conclusion
The vulnerability in pycrypto allows remote attackers to execute arbitrary code through a heap-based buffer overflow. To mitigate this vulnerability, it is crucial to update pycrypto to a version that includes the fix. Users should also follow best practices for secure coding and input validation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pycrypto →
FAQ
The vulnerability allows remote attackers to execute arbitrary code, which can lead to various consequences such as remote code execution, privilege escalation, and information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just Pipfile.lock without requiring access to the code or installation.
While specific exploits for this vulnerability are not mentioned, it is important to address the vulnerability promptly by updating pycrypto to a fixed version to mitigate the risk of potential exploits.
Yes, this vulnerability can be exploited remotely by sending a specially crafted iv parameter to the cryptmsg.py script.
There is no specific information provided about active exploitation of this vulnerability. However, it is always recommended to address security vulnerabilities promptly to minimize the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pycrypto.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
