Information disclosure in PyCrypto - CVE-2018-6594

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU11125

Information disclosure in PyCrypto - CVE-2018-6594

Published: March 16, 2018


Vulnerability identifier: #VU11125
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-6594
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists in the ElGamal implementation in PyCrypto due to generation of weak ElGamal key parameters by the source code in the lib/Crypto/PublicKey/ElGamal.py file. A remote attacker can gain access to potentially sensitive information.

Affected software

PyCrypto
Amazon Linux AMI
Gentoo Linux
Fedora
IBM Cloud Pak System
IBM Integrated Analytics System
Cloud Pak for Security (CP4S)
python-crypto
PowerStore T
IBM Watson Machine Learning Accelerator
Dell EMC PowerStore Family Operating System
IBM Netezza Analytics

How to mitigate CVE-2018-6594

Install update from vendor's website.

IBM Cloud Pak System - update to 2.3.3.6
IBM Integrated Analytics System - update to 1.0.28.1
Cloud Pak for Security (CP4S) - update to 1.10.12.0
python-crypto - addressed in versions 2.6.1-15.el7, 2.6.1-22.fc26, 2.6.1-22.fc27
PowerStore T - update to 3.6.1.2-2315284
IBM Watson Machine Learning Accelerator - update to 4.0
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
IBM Netezza Analytics - update to 11.2.29

External References

Related Security Bulletins