Unscored severity · published Oct 26, 2013
CVE-2013-1445
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which…
–
CVSS
1.7%
EPSS
No
On KEV
Description
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
Pycrypto · Dlitz
through 2.6; 1.0.0; 1.0.1; 1.0.2; 2.0; 2.0.1; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1445
www.debian.org
http://www.debian.org/security/2013/dsa-2781
Exploit
http://www.openwall.com/lists/oss-security/2013/10/17/3
Exploit
https://github.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175
More from Pycrypto
9.8
CVE-2013-7459
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as…
7.5
CVE-2018-6594
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data…
–
CVE-2012-2417
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it…