CVE-2018-6594 Amazon Linux Security Advisory for python-crypto: ALAS-2018-977

Weak ElGamal key parameters in PublicKey/ElGamal.py allow attackers to obtain sensitive information by reading ciphertext:lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation. (CVE-2018-6594 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2018-977 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2018-977: Amazon Linux (python-crypto (2.6.1-1.15.amzn1) on i686)

ALAS-2018-977: Amazon Linux (python-crypto (2.6.1-1.15.amzn1) on x86_64)

ALAS-2018-977: Amazon Linux (python-crypto (2.6.1-1.15.amzn1) on src)