Some Highway Traffic Systems Open to Man-in-the-Middle Attack

Highway traffic systems deployed across the United States could be open exploit via what a group of researchers has deemed an “insufficient entropy vulnerability” in the systems’ software. According to an advisory .PDF issued late last week by the U.S. Industrial Control System Computer Emergency...

Design/Logic Flaw

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key...

Debian: Security Advisory (DSA-2502-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2502-1 (python-crypto)

The remote host is missing an update to python-crypto announced via advisory DSA 2502-1. OpenVAS Vulnerability Test $Id: deb25021.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2502-1 python-crypto Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...

Tropos Wireless Mesh Routers

Overview This advisory is a follow-up to the original advisory titled ICSA-12-297-01P—Tropos Wireless Mesh Routers Insufficient Entropy Vulnerability that was published October 23, 2012, on the ICS-CERT secure Portal library. This advisory provides mitigation details for a vulnerability that...

Debian DSA-2502-1 : python-crypto - programming error

It was discovered that that the ElGamal code in PythonCrypto, a collection of cryptographic algorithms and protocols for Python used insecure insufficient prime numbers in key generation, which lead to a weakened signature or public key space, allowing easier brute-force attacks on such keys...

FreeBSD : pycrypto -- vulnerable ElGamal key generation (f45c0049-be72-11e1-a284-0023ae8e59f0)

Dwayne C. Litzenberger of PyCrypto reports : In the ElGamal schemes for both encryption and signatures, g is supposed to be the generator of the entire Z^p group. However, in PyCrypto 2.5 and earlier, g is more simply the generator of a random sub-group of Z^p. The result is that the signature...

GLSA-201206-23 : PyCrypto: Weak key generation

The remote host is affected by the vulnerability described in GLSA-201206-23 PyCrypto: Weak key generation An error in the generate function in ElGamal.py causes PyCrypto to generate weak ElGamal keys. Impact : A remote attacker might be able to derive private keys. Workaround : There is no known...

[SECURITY] [DSA 2502-1] python-crypto security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2502-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 24, 2012 http://www.debian.org/security/faq -...

PyCrypto: Weak key generation

Background PyCrypto is the Python Cryptography Toolkit. Description An error in the generate function in ElGamal.py causes PyCrypto to generate weak ElGamal keys. Impact A remote attacker might be able to derive private keys. Workaround There is no known workaround at this time. Resolution All...

CVE-2012-2417

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key...

Design/Logic Flaw

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key...

PYSEC-2012-16

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key...

CVE-2012-2417

CVE-2012-2417 : PyCrypto before 2.6 generates ElGamal keys using inappropriate prime numbers, reducing the signature/public key space and enabling brute-force attacks to derive the private key. Connected sources confirm the issue affects PyCrypto ElGamal key generation and that fixed versions exi...

CVE-2012-2417

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key...

CVE-2012-2417

Removed by vendor...

Fedora 16 : python-crypto-2.3-6.fc16 (2012-8470)

This update is a security fix for CVE-2012-2417 insecure ElGamal key generation. Anyone using ElGamal keys should generate new keys as soon as practical any additional information about this bug will be tracked at https://bugs.launchpad.net/pycrypto/+bug/985164. Note that Tenable Network Security...

Fedora 15 : python-crypto-2.3-6.fc15 (2012-8490)

This update is a security fix for CVE-2012-2417 insecure ElGamal key generation. Anyone using ElGamal keys should generate new keys as soon as practical any additional information about this bug will be tracked at https://bugs.launchpad.net/pycrypto/+bug/985164. Note that Tenable Network Security...

Python PyCrypto密钥生成漏洞

BUGTRAQ ID: 53687 CVE ID: CVE-2012-2417 PyCrypto是使用Python编写的加密工具包。 PyCrypto 2.5之前版本在使用ElGamal方案生成密钥时存在错误，可造成缩减密钥空间，可被利用生成私钥，获取敏感信息。 0 python 2.5.x 厂商补丁： Python ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： www.python.org...

pycrypto -- vulnerable ElGamal key generation

Dwayne C. Litzenberger of PyCrypto reports: In the ElGamal schemes for both encryption and signatures, g is supposed to be the generator of the entire Z^p group. However, in PyCrypto 2.5 and earlier, g is more simply the generator of a random sub-group of Z^p. The result is that the signature spa...