Published: 29/11/2019 Updated: 14/12/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

The mpi_powm function in Libgcrypt prior to 1.6.3 and GnuPG prior to 1.4.19 allows malicious users to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg
gnupg libgcrypt
debian debian linux 7.0
debian debian linux 8.0

Several security issues were fixed in Libgcrypt ...

Several security issues were fixed in GnuPG ...

Multiple vulnerabilities were discovered in libgcrypt: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption performance CVE-201 ...

Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption p ...

Fix a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837) Fix a side-channel attack which can potentially lead to an information leak (CVE-2014-3591) Libgcrypt before 154, as used in GnuPG and other products, does not properly perform ciphertext nor ...

CWE-203 http://www.debian.org/security/2015/dsa-3185 https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html https://ieeexplore.ieee.org/document/7163050 http://www.debian.org/security/2015/dsa-3184 https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html https://nvd.nist.gov https://usn.ubuntu.com/2555-1/

CVE-2015-0837

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect