CVE-2013-1445

PyCrypto < 2.6.1 - Information Disclosure via PRNG Race Condition

Title source: llm
STIX 2.1

Description

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.

References (3)

Core 3
Core References
Exploit, Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/10/17/3
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2781

Scores

EPSS 0.0201
EPSS Percentile 78.4%

Details

CWE
CWE-310
Status published
Products (13)
dlitz/pycrypto 1.0.0
dlitz/pycrypto 1.0.1
dlitz/pycrypto 1.0.2
dlitz/pycrypto 2.0
dlitz/pycrypto 2.0.1
dlitz/pycrypto 2.1.0
dlitz/pycrypto 2.2
dlitz/pycrypto 2.3
dlitz/pycrypto 2.4
dlitz/pycrypto 2.4.1
... and 3 more
Published Oct 26, 2013
Tracked Since Feb 18, 2026