The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random
    number generator (PRNG) before allowing a child process to access it, which makes it easier for context-
    dependent attackers to obtain sensitive information by leveraging a race condition in which a child
    process is created and accesses the PRNG within the same rate-limit period as another process.
    (CVE-2013-1445)

In previous versions of PyCrypto, the Crypto.Random PRNG exhibits a race condition that may cause forked processes to generate identical sequences of 'random' numbers.

This release fixes the problem by resetting the rate-limiter when Crypto.Random.atfork() is invoked.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated python-pycrypto package fixes security vulnerability :

In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers (CVE-2013-1445).

Dwayne Litzenberger reports :

In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers.

A cryptographic vulnerability was discovered in the pseudo random number generator in python-crypto.

In some situations, a race condition could prevent the reseeding of the generator when multiple processes are forked from the same parent.
This would lead it to generate identical output on all processes, which might leak sensitive values like cryptographic keys.

ID	Name	Product	Family	Type	Severity
434926	SCA: security update for pycrypto (GHSA-x377-f64p-hf5j)	Tenable Cloud Security	SCA Checks	Local	high
434926	SCA: security update for pycrypto (GHSA-x377-f64p-hf5j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
70905	Amazon Linux AMI : python-crypto (ALAS-2013-243)	Nessus	Amazon Linux Local Security Checks	Local	medium
70818	Fedora 20 : python-crypto-2.6.1-1.fc20 (2013-19390)	Nessus	Fedora Local Security Checks	Local	medium
70681	Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:262)	Nessus	Mandriva Local Security Checks	Local	medium
70643	Fedora 18 : python-crypto-2.6.1-1.fc18 (2013-19472)	Nessus	Fedora Local Security Checks	Local	medium
70641	Fedora 19 : python-crypto-2.6.1-1.fc19 (2013-19441)	Nessus	Fedora Local Security Checks	Local	medium
70517	FreeBSD : pycrypto -- PRNG reseed race condition (c0f122e2-3897-11e3-a084-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	Local	medium
70503	Debian DSA-2781-1 : python-crypto - PRNG not correctly reseeded in some situations	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-1445

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium