-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PyCrypto | pip | < 2.6 | 2.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the insecure ElGamal key generation process in versions <2.6. The commit diff shows critical changes to the generate function in ElGamal.py: (1) replacing direct prime generation with safe prime generation (p=2q+1), (2) adding rigorous checks for the generator 'g' to prevent small subgroup attacks, and (3) fixing the private key 'x' generation to use a proper range. The original code used getPrime without ensuring safe primes and generated 'g' as a random prime smaller than 'p', violating cryptographic best practices for ElGamal. These flaws directly align with the CVE description of insufficient randomness and reduced key space.