CVE-2012-2417 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2012-2417 - Medium Severity Vulnerability

Vulnerable Library - pycrypto-2.4.tar.gz

Cryptographic modules for Python.

path: /example-python/requirements.txt

Library home page: https://pypi.python.org/packages/45/2f/e203759a099d002ef3b96f1e497d6d1b8ab56df695af8808f88bb7eff18b/pycrypto-2.4.tar.gz

Dependency Hierarchy:

• ❌ pycrypto-2.4.tar.gz (Vulnerable Library)

Vulnerability Details

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Publish Date: 2012-06-17

URL: CVE-2012-2417

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-2417

Release Date: 2012-06-17

Fix Resolution: 2.6

---

Step up your Open Source Security Game with WhiteSource here