CVE-2013-7459 (Critical) detected in pycrypto-2.6.1.tar.gz

[mend-bolt-for-github]

CVE-2013-7459 - Critical Severity Vulnerability

Vulnerable Library - pycrypto-2.6.1.tar.gz

Cryptographic modules for Python.

Library home page: https://files.pythonhosted.org/packages/60/db/645aa9af249f059cc3a368b118de33889219e0362141e75d4eaf6f80f163/pycrypto-2.6.1.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ pycrypto-2.6.1.tar.gz (Vulnerable Library)

Found in HEAD commit: 77ff04556b041eb64f146887cd0b68319138cd43

Found in base branch: master

Vulnerability Details

Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.

Publish Date: 2017-02-15

URL: CVE-2013-7459

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-7459

Release Date: 2017-02-15

Fix Resolution: python2-crypto - 2.6.1-5;python-crypto - 2.6.1-5

---

Step up your Open Source Security Game with Mend here