Every CVE Search/ Get API key

CVE-2012-2417

PyCrypto makes Use of Insufficiently Random Values

4.3 MediumFix available

CVE-2012-2417 is a medium vulnerability (CVSS 4.3) in Dlitz Pycrypto, published June 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in pycrypto 2.6.

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Exploit likelihood

2.37%Down 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
CVE-2012-2417
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
CVE-2012-2417
Updated
2026-11-02
EUVDEUVD-2012-0026 No score

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
EUVD-2012-0026
Updated
2026-11-03
GitHub AdvisoriesGHSA-v367-p58w-98h5 6.9

PyCrypto makes Use of Insufficiently Random Values

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
GHSA-v367-p58w-98h5
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-v367-p58w-98h5 6.9

PyCrypto makes Use of Insufficiently Random Values

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
GHSA-v367-p58w-98h5
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:10346-1 No score

python-pycrypto-2.6.1-4.8 on GA media

These are all security issues fixed in the python-pycrypto-2.6.1-4.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10346-1
Updated
2026-11-02
OSVPYSEC-2012-16 No score

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

Record
PYSEC-2012-16
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pycrypto
PyPI
before 2.6
2.6
python-crypto
Debian:6.0
before 2.1.0-2+squeeze1, plus listed versions
2.1.0-2
2.1.0-2+squeeze1
pycrypto
PyPI
before 2.6, plus listed versions
1.9a21.9a51.9a62.02.0.1
Show 6 moreShow less
2.1.02.22.32.42.4.12.5
2.6
pycrypto
PyPI
before 2.6, plus listed versions
1.9a21.9a51.9a62.02.0.1
Show 17 moreShow less
2.1.02.22.32.42.4.12.5v2.3v2.2v2.1.0v2.1.0b1v2.1.0alpha2v2.1.0alpha1v1.9a5v1.9a4v1.9a3v1.9a2v1.9a1
2.6

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 16 moreShow less
MoveEnter Open