Amazon Linux 1 Security Advisory: ALAS-2018-977
Advisory Release Date: 2018-03-21 22:26 Pacific
Advisory Updated Date: 2018-03-23 17:41 Pacific
Weak ElGamal key parameters in PublicKey/ElGamal.py allow attackers to obtain sensitive information by reading ciphertext:
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation. (CVE-2018-6594)
Affected Packages:
python-crypto
Issue Correction:
Run yum update python-crypto to update your system.
i686:
python-crypto-debuginfo-2.6.1-1.15.amzn1.i686
python27-crypto-2.6.1-1.15.amzn1.i686
python26-crypto-2.6.1-1.15.amzn1.i686
src:
python-crypto-2.6.1-1.15.amzn1.src
x86_64:
python26-crypto-2.6.1-1.15.amzn1.x86_64
python27-crypto-2.6.1-1.15.amzn1.x86_64
python-crypto-debuginfo-2.6.1-1.15.amzn1.x86_64