lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive…
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
https://cwe.mitre.org/data/definitions/325.html →Open in CWE collection →The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
https://cwe.mitre.org/data/definitions/326.html →Open in CWE collection →An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
https://capec.mitre.org/data/definitions/20.html →Open in CAPEC collection →Many languages use code signing facilities to vouch for code's identity and to thus tie code to its assigned privileges within an environment. Subverting this mechanism can be instrumental in an attacker escalating privilege. Any means of subverting the way that a virtual machine enforces code signing classifies for this style of attack.
https://capec.mitre.org/data/definitions/68.html →Open in CAPEC collection →In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
https://capec.mitre.org/data/definitions/112.html →Open in CAPEC collection →An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
https://capec.mitre.org/data/definitions/192.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| pycryptodome | Tracked | |
| pycryptodome | Tracked | |
| pycryptodome | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| python-crypto | Tracked | |
| debian_linux | * | Tracked |
| pycrypto | * | Tracked |
| ubuntu_linux | * | Tracked |