ASA-201701-26 generated external raw

[ASA-201701-26] python-crypto: arbitrary code execution
Arch Linux Security Advisory ASA-201701-26 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python-crypto Type : arbitrary code execution Remote : Yes Link : Summary ======= The package python-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ==========