[arch-security] [ASA-201701-26] python-crypto: arbitrary code execution
anthraxx at archlinux.org
Mon Jan 16 17:26:08 UTC 2017
Arch Linux Security Advisory ASA-201701-26
Date : 2017-01-15
CVE-ID : CVE-2013-7459
Package : python-crypto
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-118
The package python-crypto before version 2.6.1-5 is vulnerable to
arbitrary code execution.
Upgrade to 2.6.1-5.
# pacman -Syu "python-crypto>=2.6.1-5"
The problem has been fixed upstream but no release is available yet.
A heap-buffer overflow vulnerability was discovered in pycrypto leading
to arbitrary code execution. All users of pycrypto's AES module that
allow the mode of operation to be specified by an attacker, check for
ECB explicitly and create the objects without specifying an IV are
vulnerable to this issue.
A remote attacker is able to execute arbitrary code by passing certain
parameters to the AES module.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security