CVE-2013-1445

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.

Affected Software

Name	Vendor	Start Version	End Version
Pycrypto	Dlitz	*	2.6 (including)
Pycrypto	Dlitz	1.0.0 (including)	1.0.0 (including)
Pycrypto	Dlitz	1.0.1 (including)	1.0.1 (including)
Pycrypto	Dlitz	1.0.2 (including)	1.0.2 (including)
Pycrypto	Dlitz	2.0 (including)	2.0 (including)
Pycrypto	Dlitz	2.0.1 (including)	2.0.1 (including)
Pycrypto	Dlitz	2.1.0 (including)	2.1.0 (including)
Pycrypto	Dlitz	2.2 (including)	2.2 (including)
Pycrypto	Dlitz	2.3 (including)	2.3 (including)
Pycrypto	Dlitz	2.4 (including)	2.4 (including)
Pycrypto	Dlitz	2.4.1 (including)	2.4.1 (including)
Pycrypto	Dlitz	2.5 (including)	2.5 (including)
Python-crypto	Ubuntu	lucid	*
Python-crypto	Ubuntu	precise	*
Python-crypto	Ubuntu	precise/esm	*
Python-crypto	Ubuntu	quantal	*
Python-crypto	Ubuntu	raring	*
Python-crypto	Ubuntu	saucy	*
Python-crypto	Ubuntu	upstream	*
Python-crypto	Ubuntu	utopic	*
Python-crypto	Ubuntu	vivid	*
Python-crypto	Ubuntu	wily	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-1445
CWE	https://cwe.mitre.org/data/definitions/310.html

Affected Software

References