Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
91
security advisorygentoobuffer overflowGentoo: GLSA-201702-14 Moderate: PyCrypto Remote Code Execution
A heap-based buffer overflow in PyCrypto might allow remote attackers to execute arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201702-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PyCrypto: Remote execution of arbitrary code Date: February 20, 2017 Bugs: #576494 ID: 201702-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A heap-based buffer overflow in PyCrypto might allow remote attackersto execute arbitrary code. Background ========= The Python Cryptography Toolkit (PyCrypto) is a collection of both secure hash functions (such as SHA256 and RIPEMD160), and various encryption algorithms (AES, DES, RSA, ElGamal, etc.). Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/pycrypto < 2.6.1-r2 > = 2.6.1-r2 Description ========== A heap-based buffer overflow vulnerability has been discovered in PyCrypto. Please review the CVE identifier referenced below for details. Impact ===== A remote attacker, able to control the mode of operation in PyCrypto's AES module, could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All PyCrypto users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/pycrypto-2.6.1-r2" References ========= [ 1 ] CVE-2013-7459 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7459 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201702-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Feb 21, 2017
Gentoo
89
security advisoryFedoracode executionFedora 25: FEDORA-2017-7c569d396b Critical: Pycrypto Heap Overflow Risk
A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. This is CVE-2013-7459.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-7c569d396b 2017-01-30 21:12:11.410680 -------------------------------------------------------------------------------- Name : python-crypto Product : Fedora 25 Version : 2.6.1 Release : 13.fc25 URL : https://www.pycrypto.org/ Summary : Cryptography library for Python Description : PyCrypto is a collection of both secure hash functions (such as MD5 and SHA), and various encryption algorithms (AES, DES, RSA, ElGamal, etc.). -------------------------------------------------------------------------------- Update Information: A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. This is CVE-2013-7459. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1409754 - CVE-2013-7459 pycrypto: Heap-buffer overflow in ALGobject structure https://bugzilla.redhat.com/show_bug.cgi?id=1409754 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade python-crypto' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jan 30, 2017
•Critical
Fedora
91
security advisorygentooremote attackGentoo GLSA 201206-23 Normal: PyCrypto Weak Key Generation Risk
PyCrypto generates weak ElGamal keys.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201206-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PyCrypto: Weak key generation Date: June 24, 2012 Bugs: #417625 ID: 201206-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= PyCrypto generates weak ElGamal keys. Background ========= PyCrypto is the Python Cryptography Toolkit. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/pycrypto < 2.6 > = 2.6 Description ========== An error in the generate() function in ElGamal.py causes PyCrypto to generate weak ElGamal keys. Impact ===== A remote attacker might be able to derive private keys. Workaround ========= There is no known workaround at this time. Resolution ========= All PyCrypto users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/pycrypto-2.6" References ========= [ 1 ] CVE-2012-2417 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2417 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201206-23 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jun 24, 2012
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!