Mostly copying from https://stackoverflow.com/a/58077358/7976758 by @winklerrr:
WARNING: Don't use crypto
or pycrypto
anymore!
As you can read on this page, the usage of pycrypto
is not safe anymore:
Pycrypto is vulnerable to a heap-based buffer overflow in the ALGnew function in block_templace.c. It allows remote attackers to execute arbitrary code in the python application. It was assigned the CVE-2013-7459 number.
Pycrypto didn’t release any fix to that vulnerability and no commit was made to the project since Jun 20, 2014.
Update 2021-01-18: The CVE is fixed now (thanks @SumitBadsara for pointing it out!). You can find the current status of the open security tickets for each package at the Debian security tracker:
Use Python3's pycryptodome
instead!
Make sure to uninstall all versions of crypto
and pycrypto
first, then install pycryptodome
:
pip3 uninstall crypto
pip3 uninstall pycrypto
pip3 install pycryptodome
(phd — skipping a part about virtual environments…)
All of these three packages get installed to the same folder, named Crypto
. Installing different packages under the same folder name can be a common source for errors!
For more information, see pycryptodome.org