CVE-2018-6594
python3-crypto: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attacke...
CVE-2018-6594 is fixed in 6 products on 1 platform, first by python-crypto 2.6.1-8ubuntu2, released February 2, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0203
81st percentile
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-crypto · Ubuntu 18.04.6 LTS (bionic) | 2.6.1-8ubuntu2 | python-crypto 2.6.1-8ubuntu2 | Feb 2, 2018 |
| python-crypto-debugsource · amzn 2023 | 2.6.1-34.amzn2023.0.2 | ALAS2023-2025-1051 | Jun 27, 2025 |
| python-pycryptodome · Ubuntu 18.04.6 LTS (bionic) | 3.4.7-1ubuntu1 | python-pycryptodome 3.4.7-1ubuntu1 | Feb 2, 2018 |
| python3-crypto · Ubuntu 18.04.6 LTS (bionic) | 2.6.1-8ubuntu2 | python3-crypto 2.6.1-8ubuntu2 | Feb 2, 2018 |
| python3-crypto · amzn 2023 | 2.6.1-34.amzn2023.0.2 | ALAS2023-2025-1051 | Jun 27, 2025 |
| python3-crypto-debuginfo · amzn 2023 | 2.6.1-34.amzn2023.0.2 | ALAS2023-2025-1051 | Jun 27, 2025 |
| python3-pycryptodome · Ubuntu 18.04.6 LTS (bionic) | 3.4.7-1ubuntu1 | python3-pycryptodome 3.4.7-1ubuntu1 | Feb 2, 2018 |