WARNING: Don't use crypto or pycrypto anymore!警告:不要再使用 crypto 或 pycrypto!
As you can read on this page, the usage of pycrypto is not safe anymore:正如您在此页面上所读到的,pycrypto 的使用不再安全:
Pycrypto is vulnerable to a heap-based buffer overflow in the ALGnew function in block_templace.c. It allows remote attackers to execute arbitrary code in the python application. It was assigned the CVE-2013-7459 number.Pycrypto 容易受到 block_tempplace.c 中 ALGnew 函数中基于堆的缓冲区溢出的影响。它允许远程攻击者在Python应用程序中执行任意代码。它被分配了 CVE-2013-7459 编号。
Pycrypto didn’t release any fix to that vulnerability and no commit was made to the project since Jun 20, 2014.自 2014 年 6 月 20 日以来,Pycrypto 没有发布针对该漏洞的任何修复程序,也没有对该项目进行任何提交。
Update 2021-01-18 更新2021-01-18
The CVE is fixed now (thanks @SumitBadsara for pointing it out!). You can find the current status of the open security tickets for each package at the Debian security tracker:CVE 现已修复(感谢 @SumitBadsara 指出!)。您可以在 Debian 安全跟踪器中找到每个软件包的开放安全票证的当前状态:
Use Python3's pycryptodome instead!使用Python3的pycryptodome来代替!
Make sure to uninstall all versions of crypto and pycrypto first, then install pycryptodome:确保先卸载 crypto 和 pycrypto 的所有版本,然后安装 pycryptodome :
pip3 uninstall crypto
pip3 uninstall pycrypto
pip3 install pycryptodome
All of these three packages get installed to the same folder, named Crypto. Installing different packages under the same folder name can be a common source for errors!所有这三个包都安装到同一个文件夹中,名为 Crypto 。在同一文件夹名称下安装不同的软件包可能是错误的常见来源!
For more information, see pycryptodome.org.有关更多信息,请参阅 pycryptodome.org 。
Best practice: virtual environments最佳实践:虚拟环境
In order to avoid problems with pip packages in different versions or packages that install under the same folder (i.e. pycrypto and pycryptodome) you can make use of a so called virtual environment. There, the installed pip packages can be managed for every single project individually.为了避免不同版本的 pip 包或安装在同一文件夹下的包(即 pycrypto 和 pycryptodome )出现问题,您可以使用所谓的虚拟环境。在那里,可以为每个项目单独管理已安装的 pip 包。
To install a virtual environment and setup everything, use the following commands:要安装虚拟环境并设置所有内容,请使用以下命令:
sudo apt update
sudo apt upgrade
sudo apt install python3
sudo apt install python3-pip
pip3 install virtualenv
mkdir target_folder
cd target_folder
python3 -m virtualenv .
source bin/activate
pip3 install pycryptodome
python
>>> from Crypto.Cipher import AES
>>> exit()
deactivate
For more information, see docs.python-guide.org.有关更多信息,请参阅 docs.python-guide.org 。
ImportErrorpython 2python 3ModuleNotFoundErrorImportError显示在python 2中,而在python 3中显示ModuleNotFoundError。python3 -c 'import foo'ImportError: No module named 'foo'python3 -c 'import foo'产生ImportError: No module named 'foo'。我错过了什么吗?