Published: 29/11/2019 Updated: 05/12/2019

CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4

CVSS v3 Base Score: 4.2 | Impact Score: 3.6 | Exploitability Score: 0.5

VMScore: 170

Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N

Libgcrypt prior to 1.6.3 and GnuPG prior to 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate malicious users to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg
gnupg libgcrypt
debian debian linux 7.0
debian debian linux 8.0

Several security issues were fixed in Libgcrypt ...

Several security issues were fixed in GnuPG ...

Multiple vulnerabilities were discovered in libgcrypt: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption performance CVE-201 ...

Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption p ...

Fix a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837) Fix a side-channel attack which can potentially lead to an information leak (CVE-2014-3591) Libgcrypt before 154, as used in GnuPG and other products, does not properly perform ciphertext nor ...

CWE-200 https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html http://www.debian.org/security/2015/dsa-3185 http://www.cs.tau.ac.il/~tromer/radioexp/https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html http://www.debian.org/security/2015/dsa-3184 https://nvd.nist.gov https://usn.ubuntu.com/2555-1/

CVE-2014-3591

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect