Critical Vulnerability in Python-Crypto and PyCryptodome Packages: Weak ElGamal Key Generation
Summary
UBUNTU-CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security... Affects python-crypto versions < 2.6.1-4ubuntu0.3. Fixed in 2.6.1-4ubuntu0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Crypto is a collection of cryptographic algorithms and protocols for Python, widely used for secure data transmission. PyCryptodome is a self-contained Python package of low-level cryptographic primitives. Both packages are essential for developers needing cryptographic functionalities. However, they are vulnerable to a significant security flaw that compromises the integrity of ElGamal key generation, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the ElGamal implementation in PyCrypto versions up to 2.6.1, where weak key parameters are generated. This flaw allows attackers to exploit the system by reading ciphertext data, undermining the semantic security of the encryption. The Decisional Diffie-Hellman (DDH) assumption does not hold, making the encryption susceptible to ciphertext-only attacks. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.6.1-4ubuntu0.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-cryptoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ElGamal implementation in PyCrypto until the package is updated. Consider using alternative cryptographic libraries that do not exhibit this vulnerability.
Conclusion
The vulnerability in the Python-Crypto and PyCryptodome packages poses a significant risk due to weak ElGamal key generation. It is essential to update to the patched versions to mitigate this risk. Users should also consider using alternative libraries and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python-crypto →
FAQ
The vulnerability involves weak ElGamal key generation in the Python-Crypto package, allowing attackers to potentially decrypt sensitive information.
Versions of python-crypto up to 2.6.1 and pycryptodome up to 3.4.7 are affected across various Ubuntu distributions.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If immediate updates are not possible, avoid using the vulnerable ElGamal implementation and consider alternative libraries for cryptographic functions.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-crypto.
