VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Feb 15, 2017· Updated May 13, 2026

CVE-2013-7459

CVE-2013-7459

Description

Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pycryptoPyPI
<= 2.6.1—

Affected products

3
  • Dlitz/Pycrypto
    cpe:2.3:a:dlitz:pycrypto:*:*:*:*:*:*:*:*
    Range: <=2.6.1
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

Patches

1
8dbe0dc3eea5

Throw exception when IV is used with ECB or CTR

https://github.com/dlitz/pycryptoLegrandinDec 22, 2013via ghsa
commit
2 files changed · +34 −8
  • lib/Crypto/SelfTest/Cipher/common.py+23 −8 modified
    @@ -605,19 +605,34 @@ def shortDescription(self):
         return """%s .decrypt() output of .encrypt() should not be garbled""" % (self.module_name,)
 
     def runTest(self):
-        for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP):
+
+        ## ECB mode
+        mode = self.module.MODE_ECB
+        encryption_cipher = self.module.new(a2b_hex(self.key), mode)
+        ciphertext = encryption_cipher.encrypt(self.plaintext)
+        decryption_cipher = self.module.new(a2b_hex(self.key), mode)
+        decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
+        self.assertEqual(self.plaintext, decrypted_plaintext)
+
+        ## OPENPGP mode
+        mode = self.module.MODE_OPENPGP
+        encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
+        eiv_ciphertext = encryption_cipher.encrypt(self.plaintext)
+        eiv = eiv_ciphertext[:self.module.block_size+2]
+        ciphertext = eiv_ciphertext[self.module.block_size+2:]
+        decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)
+        decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
+        self.assertEqual(self.plaintext, decrypted_plaintext)
+
+        ## All other non-AEAD modes (but CTR)
+        for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB):
             encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
             ciphertext = encryption_cipher.encrypt(self.plaintext)
-
-            if mode != self.module.MODE_OPENPGP:
-                decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
-            else:
-                eiv = ciphertext[:self.module.block_size+2]
-                ciphertext = ciphertext[self.module.block_size+2:]
-                decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)
+            decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
             decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
             self.assertEqual(self.plaintext, decrypted_plaintext)
 
+
 class PGPTest(unittest.TestCase):
     def __init__(self, module, params):
         unittest.TestCase.__init__(self)
  • src/block_template.c+11 −0 modified
    @@ -158,6 +158,17 @@ ALGnew(PyObject *self, PyObject *args, PyObject *kwdict)
 				"Key cannot be the null string");
 		return NULL;
 	}
+	if (IVlen != 0 && mode == MODE_ECB)
+	{
+		PyErr_Format(PyExc_ValueError, "ECB mode does not use IV");
+		return NULL;
+	}
+	if (IVlen != 0 && mode == MODE_CTR)
+	{
+		PyErr_Format(PyExc_ValueError,
+			"CTR mode needs counter parameter, not IV");
+		return NULL;
+	}
 	if (IVlen != BLOCK_SIZE && mode != MODE_ECB && mode != MODE_CTR)
 	{
 		PyErr_Format(PyExc_ValueError,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.