CVE-2012-2417

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-17 · updated 2026-06-16
Weakness: CWE-310

Description

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Affected products

Dlitz Pycrypto: through 2.5; 1.0.0, 1.0.1, 1.0.2, 1.1-alpha2, 1.9-alpha1, 1.9-alpha2 (+14)

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081759.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081789.html
http://secunia.com/advisories/49263
http://www.debian.org/security/2012/dsa-2502
http://www.mandriva.com/security/advisories?name=MDVSA-2012:117
http://www.openwall.com/lists/oss-security/2012/05/25/1
http://www.osvdb.org/82279
http://www.securityfocus.com/bid/53687
https://bugs.launchpad.net/pycrypto/+bug/985164
https://exchange.xforce.ibmcloud.com/vulnerabilities/75871
https://github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2

Get alerted when CVE-2012-2417 or the next vulnerability affects your stack