CVE-2012-2417
PyCrypto makes Use of Insufficiently Random Values
CVE-2012-2417 is a medium vulnerability (CVSS 4.3) in Dlitz Pycrypto, published June 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in pycrypto 2.6.
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
Exploit likelihood
What each source reports
NVD Score used
4.3
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
CVE-2012-2417- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
CVE-2012-2417- Updated
- 2026-11-02
EUVDEUVD-2012-0026 No score
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
EUVD-2012-0026- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v367-p58w-98h5
6.9
PyCrypto makes Use of Insufficiently Random Values
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
GHSA-v367-p58w-98h5- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-v367-p58w-98h5
6.9
PyCrypto makes Use of Insufficiently Random Values
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
GHSA-v367-p58w-98h5- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10346-1 No score
python-pycrypto-2.6.1-4.8 on GA media
These are all security issues fixed in the python-pycrypto-2.6.1-4.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10346-1- Updated
- 2026-11-02
OSVPYSEC-2012-16 No score
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
- Record
PYSEC-2012-16- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pycryptoPyPI |
before 2.6 | 2.6 |
python-cryptoDebian:6.0 |
before 2.1.0-2+squeeze1, plus listed versions 2.1.0-2 |
2.1.0-2+squeeze1 |
pycryptoPyPI |
before 2.6, plus listed versions 1.9a21.9a51.9a62.02.0.1 Show 6 moreShow less2.1.02.22.32.42.4.12.5 |
2.6 |
pycryptoPyPI |
before 2.6, plus listed versions 1.9a21.9a51.9a62.02.0.1 Show 17 moreShow less2.1.02.22.32.42.4.12.5v2.3v2.2v2.1.0v2.1.0b1v2.1.0alpha2v2.1.0alpha1v1.9a5v1.9a4v1.9a3v1.9a2v1.9a1 |
2.6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2012/dsa-2502
osvdb.org/82279
lists.fedoraproject.org/pipermail/package-announce/2012-June/081789.html
github.com/Legrandin/pycrypto/commit/9f912f13df99ad3421eff360d6a62d7dbec755c2
mandriva.com/security/advisories?name=MDVSA-2012:117
securityfocus.com/bid/53687
Show 16 moreShow less
bugs.launchpad.net/pycrypto/+bug/985164
lists.fedoraproject.org/pipermail/package-announce/2012-June/081713.html
secunia.com/advisories/49263
lists.fedoraproject.org/pipermail/package-announce/2012-June/081759.html
openwall.com/lists/oss-security/2012/05/25/1
hermes.opensuse.org/messages/15083589
exchange.xforce.ibmcloud.com/vulnerabilities/75871
github.com/dlitz/pycrypto/blob/373ea760f21701b162e8c4912a66928ee30d401a/ChangeLog
nvd.nist.gov/vuln/detail/CVE-2012-2417
web.archive.org/web/20140724111917/http://secunia.com/advisories/49263
web.archive.org/web/20200228184120/http://www.securityfocus.com/bid/53687
github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2012-16.yaml
github.com/advisories/GHSA-v367-p58w-98h5
github.com/Legrandin/pycrypto
suse.com/security/cve/CVE-2012-2417
suse.com/security/cve/CVE-2013-1445