CVE-2013-1445

Description

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.

How to fix CVE-2013-1445

To remediate CVE-2013-1445, upgrade the affected package to a fixed version below.

• —upgrade to 2.1.0-2+squeeze2 or later
• —upgrade to 2.6.1 or later
• —upgrade to 19dcf7b15d61b7dc1a125a367151de40df6ef175 or later

Is CVE-2013-1445 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 2.1.0-2+squeeze2
• from 0, < 2.6.1
• from 0, < 19dcf7b15d61b7dc1a125a367151de40df6ef175 | from 0, < 2.6.1

CVSS scores

References (7)

• ADVISORYgithub.com/advisories/GHSA-x377-f64p-hf5j
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-1445
• PATCHgithub.com/pycrypto/pycrypto
• WEBgithub.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175