~ / search / GHSA-x377-f64p-hf5j

GHSA-x377-f64p-hf5j

PyCrypto does not properly reseed PRNG before allowing access

Source: GitHub Advisory Database (reviewed) High CVE-2013-1445

Packages

EcosystemPackageAffectedFixed in
PyPI pycrypto < 2.6.1 2.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.

References

External links from the advisory. They lead to third-party sites.