High severityNVD Advisory· Published Oct 26, 2013· Updated Jun 16, 2026
CVE-2013-1445
CVE-2013-1445
Description
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pycryptoPyPI | < 2.6.1 | 2.6.1 |
Affected products
13cpe:2.3:a:dlitz:pycrypto:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:dlitz:pycrypto:*:*:*:*:*:*:*:*range: <=2.6
- cpe:2.3:a:dlitz:pycrypto:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.4:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:2.5:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
6- www.openwall.com/lists/oss-security/2013/10/17/3nvdExploitPatchWEB
- github.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175nvdExploitWEB
- github.com/advisories/GHSA-x377-f64p-hf5jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-1445ghsaADVISORY
- www.debian.org/security/2013/dsa-2781nvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2013-29.yamlghsaWEB
News mentions
0No linked articles in our index yet.