Skip to content
OpenAdvisories
Medium ALAS2023-2025-1051 1 CVE

Moderate: python-crypto security update (Amazon Linux 2023)

Published Jun 27, 2025 · Updated Jul 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2018-6594: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 python-crypto-debugsource 0:2.6.1-34.amzn2023.0.2
Amazon Linux · 2023 python3-crypto 0:2.6.1-34.amzn2023.0.2
Amazon Linux · 2023 python3-crypto-debuginfo 0:2.6.1-34.amzn2023.0.2

Vulnerabilities 1

  • High 7.5
    CVE-2018-6594

    Pycrypto generates weak key parameters

    lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). …

    pycrypto pycryptodome pycryptodome python-crypto Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-6594.html