ALAS-2018-977


Amazon Linux 1 Security Advisory: ALAS-2018-977
Advisory Release Date: 2018-03-21 22:26 Pacific
Advisory Updated Date: 2018-03-23 17:41 Pacific
Severity: Medium

Issue Overview:

Weak ElGamal key parameters in PublicKey/ElGamal.py allow attackers to obtain sensitive information by reading ciphertext:
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation. (CVE-2018-6594)


Affected Packages:

python-crypto


Issue Correction:
Run yum update python-crypto to update your system.

New Packages:
i686:
    python-crypto-debuginfo-2.6.1-1.15.amzn1.i686
    python27-crypto-2.6.1-1.15.amzn1.i686
    python26-crypto-2.6.1-1.15.amzn1.i686

src:
    python-crypto-2.6.1-1.15.amzn1.src

x86_64:
    python26-crypto-2.6.1-1.15.amzn1.x86_64
    python27-crypto-2.6.1-1.15.amzn1.x86_64
    python-crypto-debuginfo-2.6.1-1.15.amzn1.x86_64