{"id":"CVE-2018-6594","aliases":["DEBIAN-CVE-2018-6594","EUVD-2018-0119","GHSA-6528-wvf6-f6qg","MGASA-2018-0171","PYSEC-2018-97","UBUNTU-CVE-2018-6594","USN-3616-1"],"status":"published","title":"Pycrypto generates weak key parameters","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02031,"percentile":0.81195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-326"],"published":"2018-02-03T00:00:00Z","modified":"2026-10-23T18:03:48Z","fixes":[{"ecosystem":"Debian:12","package":"pycryptodome","fixed_in":["3.4.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pycryptodome","fixed_in":["3.4.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pycryptodome","fixed_in":["3.4.11-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-pycrypto","fixed_in":["2.6.1-6.2.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"python-pycrypto","fixed_in":["2.6.1-9.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","fixed_in":["2.6.1-4ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","fixed_in":["2.6.1-6ubuntu0.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pycryptodome","fixed_in":["3.4.7-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-crypto","fixed_in":["2.6.1-8ubuntu2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pycryptodome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pycryptodome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pycryptodome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.11-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}],"versions":["1.9a2","1.9a5","1.9a6","2.0","2.0.1","2.1.0","2.2","2.3","2.4","2.4.1","2.5","2.6","2.6.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6.2.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"python-pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-9.1.mga6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pycrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9a2","1.9a5","1.9a6","2.0","2.0.1","2.1.0","2.2","2.3","2.4","2.4.1","2.5","2.6","2.6.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4ubuntu0.3"}]}],"versions":["2.6-5","2.6.1-2","2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1","2.6.1-4ubuntu0.1","2.6.1-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6ubuntu0.16.04.3"}]}],"versions":["2.6.1-5build1","2.6.1-6","2.6.1-6build1","2.6.1-6ubuntu0.16.04.1","2.6.1-6ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pycryptodome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.7-1ubuntu1"}]}],"versions":["3.4.6-1","3.4.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-8ubuntu2"}]}],"versions":["2.6.1-7build2","2.6.1-8"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-4ubuntu0.3"}]}],"versions":["2.6-5","2.6.1-2","2.6.1-2build1","2.6.1-3","2.6.1-4","2.6.1-4build1","2.6.1-4ubuntu0.1","2.6.1-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-6ubuntu0.16.04.3"}]}],"versions":["2.6.1-5build1","2.6.1-6","2.6.1-6build1","2.6.1-6ubuntu0.16.04.1","2.6.1-6ubuntu0.16.04.2"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"dlitz","product":"pycrypto"}],"references":[{"url":"https://github.com/TElgamal/attack-on-pycrypto-elgamal","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://usn.ubuntu.com/3616-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/dlitz/pycrypto/issues/253","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3616-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202007-62","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6594","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6528-wvf6-f6qg","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2018-97.yaml","tags":["web"]},{"url":"https://usn.ubuntu.com/3616-1","tags":["web"]},{"url":"https://usn.ubuntu.com/3616-2","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6594","tags":["advisory"]},{"url":"https://github.com/dlitz/pycrypto","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0171.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22693","tags":["report"]},{"url":"https://github.com/Legrandin/pycryptodome/issues/90","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6594","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3616-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3616-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6594","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-6594","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T03:00:00Z","modified":"2024-08-05T06:10:10.652Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-0119","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T03:00:00Z","modified":"2024-08-05T06:10:10Z","updated_at":"2026-11-03T02:40:08.072854Z"}],"ghsa":[{"id":"GHSA-6528-wvf6-f6qg","title":"Pycrypto generates weak key parameters","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-07-12T20:29:26Z","modified":"2024-10-18T21:58:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2018-6594","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T15:29:00.653Z","modified":"2026-06-17T02:02:04.427Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-6594","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T15:29:00.653Z","modified":"2026-10-20T10:51:34.909382552Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6594","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T15:29:00.653Z","modified":"2026-10-23T18:03:48.565620664Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-6528-wvf6-f6qg","title":"Pycrypto generates weak key parameters","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-07-12T20:29:26Z","modified":"2024-10-18T22:22:56.95848Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2018-6594","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T00:00:00Z","modified":"2026-02-04T03:51:06.182704Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"MGASA-2018-0171","title":"Updated python-pycrypto packages fix security vulnerability","description":"The textbook ElGamal implementation is not secure. PyCrypto and some\nother implementations use the wrong algorithm, which may lead to some\ninformation disclosure simply by looking at the encrypted text. For a\nfull description, see https://github.com/dlitz/pycrypto/issues/253\nThis update includes a fix for this problem backported from pycryptodome.\n","status":"published","published":"2018-03-19T12:13:14Z","modified":"2026-04-16T06:24:34.14270126Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"PYSEC-2018-97","description":"lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.","status":"published","published":"2018-02-03T15:29:00Z","modified":"2023-11-08T04:00:21.756085Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"USN-3616-1","title":"python-crypto vulnerability","description":"It was discovered that Python Crypto incorrectly generated ElGamal key\nparameters. A remote attacker could possibly use this issue to obtain\nsensitive information.\n","status":"published","published":"2018-04-03T16:53:52Z","modified":"2026-02-10T04:41:18Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}