—

PYSEC-2012-1

Quick fix

PYSEC-2012-1 — beaker: upgrade to the fixed version with the command below.

pip install --upgrade 'beaker>=91becae76101cf87ce8cbfabe3af2622fc328fe5'

Details

Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/beaker

Introduced in: 0Fixed in: 91becae76101cf87ce8cbfabe3af2622fc328fe5

Fixpip install --upgrade 'beaker>=91becae76101cf87ce8cbfabe3af2622fc328fe5'

References

http://www.debian.org/security/2012/dsa-2541[ADVISORY]
http://secunia.com/advisories/50520[ADVISORY]
http://www.openwall.com/lists/oss-security/2012/08/13/10[WEB]
https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5[FIX]
http://secunia.com/advisories/50226[ADVISORY]
https://bugzilla.redhat.com/show_bug.cgi?id=809267[REPORT]
https://github.com/advisories/GHSA-39vm-p9mr-4r27[ADVISORY]