Debian DLA-1283-2 : python-crypto security update

high Nessus Plugin ID 106819

Language:

Synopsis

The remote Debian host is missing a security update.

Description

This is an update to DLA-1283-1. In DLA-1283-1 it is claimed that the issue described in CVE-2018-6594 is fixed. It turns out that the fix is partial and upstream has decided not to fix the issue as it would break compatibility and that ElGamal encryption was not intended to work on its own.

The recommendation is still to upgrade python-crypto packages. In addition please take into account that the fix is not complete. If you have an application using python-crypto is implementing ElGamal encryption you should consider changing to some other encryption method.

There will be no further update to python-crypto for this specific CVE. A fix would break compatibility, the problem has been ignored by regular Debian Security team due to its minor nature and in addition to that we are close to the end of life of the Wheezy security support.

CVE-2018-6594 :

python-crypto generated weak ElGamal key parameters, which allowed attackers to obtain sensitive information by reading ciphertext data (i.e., it did not have semantic security in face of a ciphertext-only attack).

We recommend that you upgrade your python-crypto packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected packages.

Plugin Details

Severity: High

ID: 106819

File Name: debian_DLA-1283.nasl

Version: 3.6

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/15/2018

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:python3-crypto-dbg, p-cpe:/a:debian:debian_linux:python-crypto, cpe:/o:debian:debian_linux:7.0, p-cpe:/a:debian:debian_linux:python-crypto-doc, p-cpe:/a:debian:debian_linux:python-crypto-dbg, p-cpe:/a:debian:debian_linux:python3-crypto

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 4/9/2018

Detections

Analytics