From: Ben Bangert <ben@groovie.org>
Subject : Fix security issue CVE-2012-3458

  Fix security issue, with PyCrypto not securing data such that an attacker
  could possibly determine parts of the encrypted payload. Patch by Miloslav
  Trmac of Redhat. [CVE-2012-3458]

Origin: upstream, https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5
Bug-Debian: http://bugs.debian.org/684890

--- beaker-1.6.3.orig/beaker/crypto/pycrypto.py
+++ beaker-1.6.3/beaker/crypto/pycrypto.py
@@ -15,17 +15,18 @@ try:
 
 except ImportError:
     from Crypto.Cipher import AES
+    from Crypto.Util import Counter
 
     def aesEncrypt(data, key):
-        cipher = AES.new(key)
+        cipher = AES.new(key, AES.MODE_CTR,
+                         counter=Counter.new(128, initial_value=0))
 
-        data = data + (" " * (16 - (len(data) % 16)))
         return cipher.encrypt(data)
 
     def aesDecrypt(data, key):
-        cipher = AES.new(key)
-
-        return cipher.decrypt(data).rstrip()
+        cipher = AES.new(key, AES.MODE_CTR,
+                         counter=Counter.new(128, initial_value=0))
+        return cipher.decrypt(data)
 
 def getKeyLength():
     return 32
