{"id":"CVE-2013-7459","aliases":["DEBIAN-CVE-2013-7459","DLA-773-1","EUVD-2017-0102","GHSA-cq27-v7xp-c356","MGASA-2017-0032","PYSEC-2017-94","SUSE-SU-2017:1744-1","SUSE-SU-2017:2350-1","UBUNTU-CVE-2013-7459","USN-3199-1","USN-3199-2"],"status":"published","title":"Buffer Overflow in pycrypto","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09578,"percentile":0.95502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-01-01T00:00:00Z","modified":"2026-06-17T00:02:00Z","fixes":[{"ecosystem":"Debian:7","package":"python-crypto","fixed_in":["2.6-4+deb7u4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-pycrypto","fixed_in":["2.6.1-6.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"python-pycrypto","fixed_in":["2.6.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"python-pycrypto","fixed_in":["2.6.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"python-paramiko","fixed_in":["1.15.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-paramiko","fixed_in":["1.15.2-2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.0","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.1","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.1","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 3","package":"python-paramiko","fixed_in":["1.15.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 3","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"python-pycrypto","fixed_in":["2.6.1-10.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","fixed_in":["2.6.1-4ubuntu0.1","2.6.1-4ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","fixed_in":["2.6.1-6ubuntu0.16.04.1","2.6.1-6ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-4+deb7u4"}]}],"versions":["2.6-4","2.6-4+deb7u2","2.6-4+deb7u3"]},{"source":"osv","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}],"versions":["1.9a2","1.9a5","1.9a6","2.0","2.0.1","2.1.0","2.2","2.3","2.4","2.4.1","2.5","2.6","2.6.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6.1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9a2","1.9a5","1.9a6","2.0","2.0.1","2.1.0","2.2","2.3","2.4","2.4.1","2.5","2.6","2.6.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Advanced Systems Management 12","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 12 SP2","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.0","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.1","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"python-paramiko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-10.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4ubuntu0.1"}]}],"versions":["2.6-5","2.6.1-2","2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6ubuntu0.16.04.1"}]}],"versions":["2.6.1-5build1","2.6.1-6","2.6.1-6build1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4ubuntu0.1"}]}],"versions":["2.6-5","2.6.1-2","2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6ubuntu0.16.04.1"}]}],"versions":["2.6.1-5build1","2.6.1-6","2.6.1-6build1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4ubuntu0.2"}]}],"versions":["2.6-5","2.6.1-2","2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1","2.6.1-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6ubuntu0.16.04.2"}]}],"versions":["2.6.1-5build1","2.6.1-6","2.6.1-6build1","2.6.1-6ubuntu0.16.04.1"]}],"products":[{"vendor":"dlitz","product":"pycrypto"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1409754","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","web","report"]},{"url":"https://pony7.fr/ctf:public:32c3:cryptmsg","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/27/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://github.com/dlitz/pycrypto/issues/176","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.securityfocus.com/bid/95122","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201702-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","web","advisory"]},{"url":"https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7459","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cq27-v7xp-c356","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2017-94.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE","tags":["web"]},{"url":"https://github.com/dlitz/pycrypto","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0032.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20031","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/12/27/8","tags":["web"]},{"url":"https://marc.info/?l=oss-security\u0026m=148280482630855\u0026w=2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171744-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017420","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7459","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172350-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7459","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3199-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3199-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3199-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7459","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7459","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2017-02-15T15:00:00Z","modified":"2024-08-06T18:09:16.939Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2017-0102","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2017-02-15T15:00:00Z","modified":"2024-08-06T18:09:16Z","updated_at":"2026-11-03T01:56:23.098352Z"}],"ghsa":[{"id":"GHSA-cq27-v7xp-c356","title":"Buffer Overflow in pycrypto","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2018-12-14T18:51:38Z","modified":"2024-10-18T22:00:01Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2013-7459","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2017-02-15T15:59:00.153Z","modified":"2026-06-17T00:02:00.21Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"GHSA-cq27-v7xp-c356","title":"Buffer Overflow in pycrypto","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2018-12-14T18:51:38Z","modified":"2024-10-18T22:23:12.251504Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2013-7459","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2017-02-15T00:00:00Z","modified":"2026-02-04T02:51:41.44677Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"DLA-773-1","title":"python-crypto - security update","status":"published","published":"2017-01-01T00:00:00Z","modified":"2026-03-09T02:11:01.038164Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2017-0032","title":"Updated python-pycrypto packages fix security vulnerabilities","description":"This is a security fix for a possible Buffer overflow.\nAES.new with invalid parameter crashes python.\nThe IV parameter is currently ignored when initializing a cipher in ECB\nor CTR mode.\nThere was a bug in pycrypto which could be exploited to get a shell.\n","status":"published","published":"2017-02-02T08:11:52Z","modified":"2026-04-16T06:25:30.735412133Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"PYSEC-2017-94","description":"Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.","status":"published","published":"2017-02-15T15:59:00Z","modified":"2023-11-08T03:57:29.606861Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2017:1744-1","title":"Security update for python-pycrypto","description":"This update for python-pycrypto fixes the following issues:\n\n- CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420).\n","status":"published","published":"2017-06-30T15:26:49Z","modified":"2026-02-04T03:33:41.672767Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2350-1","title":"Security update for python-pycrypto","description":"This update for python-pycrypto fixes the following issues:\n\n- CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420).\n\npython-paramiko was adjusted to work together with this python-pycrypto change. (bsc#1047666)\n\n","status":"published","published":"2017-09-05T12:41:27Z","modified":"2026-02-04T02:25:33.131366Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3199-1","title":"Python Crypto vulnerability","description":"It was discovered that the ALGnew function in block_templace.c in the Python\nCryptography Toolkit contained a heap-based buffer overflow vulnerability.\nA remote attacker could use this flaw to execute arbitrary code by using\na crafted initialization vector parameter.\n","status":"published","published":"2017-02-16T23:52:07Z","modified":"2026-02-10T04:41:05Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3199-2","title":"Python Crypto regression","description":"USN-3199-1 fixed a vulnerability in the Python Cryptography Toolkit.\nUnfortunately, various programs depended on the original behavior of the Python\nCryptography Toolkit which was altered when fixing the vulnerability. This\nupdate retains the fix for the vulnerability but issues a warning rather than\nthrowing an exception. Code which produces this warning should be updated\nbecause future versions of the Python Cryptography Toolkit re-introduce the\nexception.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that the ALGnew function in block_template.c in the Python\n Cryptography Toolkit contained a heap-based buffer overflow vulnerability.\n A remote attacker could use this flaw to execute arbitrary code by using\n a crafted initialization vector parameter.\n","status":"published","published":"2017-02-17T17:34:13Z","modified":"2026-02-10T04:41:05Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}