CVE-2013-1445
published 2013-10-26CVE-2013-1445: The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
1.73%
75.3th percentile
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlitz | pycrypto | <= 2.6 | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | — | — |
| dlitz | pycrypto | >= 0 < 2.6.1 | 2.6.1 |
| dlitz | pycrypto | >= 0 < 19dcf7b15d61b7dc1a125a367151de40df6ef175 | 19dcf7b15d61b7dc1a125a367151de40df6ef175 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python-crypto: PRNG not correctly reseeded in some situations
vendor_redhat·2013-10-17·CVSS 4.3
CVE-2013-1445 [MEDIUM] python-crypto: PRNG not correctly reseeded in some situations
python-crypto: PRNG not correctly reseeded in some situations
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
Statement: Not Vulnerable. This issue does not affect the version of python-crypto package as shipped with Red Hat Enterprise Linux 6.
Package: python-crypto (Red Hat Enterprise Linux 6) - Not affected
GHSA
PyCrypto does not properly reseed PRNG before allowing access
ghsa·2022-05-17
CVE-2013-1445 [HIGH] CWE-332 PyCrypto does not properly reseed PRNG before allowing access
PyCrypto does not properly reseed PRNG before allowing access
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
OSV
PyCrypto does not properly reseed PRNG before allowing access
osv·2022-05-17
CVE-2013-1445 [HIGH] PyCrypto does not properly reseed PRNG before allowing access
PyCrypto does not properly reseed PRNG before allowing access
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
OSV
CVE-2013-1445: The Crypto
osv·2013-10-26
CVE-2013-1445 CVE-2013-1445: The Crypto
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [epel-5]
bugzilla·2013-10-18·CVSS 4.3
CVE-2013-1445 [MEDIUM] CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [epel-5]
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel-5 tracking
Bugzilla
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations
bugzilla·2013-10-18·CVSS 4.3
CVE-2013-1445 [MEDIUM] CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations
In PyCrypto before v2.6.1, the Crypto.Random PRNG exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers.
An application may be affected if, within 100 milliseconds, it performs the following steps (which may be summarized as "read-fork-read-read"):
1. Read from the Crypto.Random PRNG, causing an internal reseed;
2. Fork the process and invoke Crypto.Random.atfork() in the child;
3. Read from the Crypto.Random PRNG again, in at least two different processes (parent and child, or multiple children).
Only applications that
Bugzilla
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [fedora-all]
bugzilla·2013-10-18·CVSS 4.3
CVE-2013-1445 [MEDIUM] CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [fedora-all]
CVE-2013-1445 python-crypto: PRNG not correctly reseeded in some situations [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: thi
http://www.debian.org/security/2013/dsa-2781http://www.openwall.com/lists/oss-security/2013/10/17/3https://github.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175http://www.debian.org/security/2013/dsa-2781http://www.openwall.com/lists/oss-security/2013/10/17/3https://github.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175
2013-10-26
Published