7.5
CVSSv3

CVE-2021-33560

Published: 08/06/2021 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

Libgcrypt prior to 1.8.8 and 1.9.x prior to 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnupg libgcrypt

debian debian linux 9.0

fedoraproject fedora 33

fedoraproject fedora 34

oracle communications cloud native core network repository function 1.14.0

oracle communications cloud native core network function cloud native environment 1.9.0

oracle communications cloud native core network slice selection function 1.8.0

oracle communications cloud native core network repository function 1.15.0

oracle communications cloud native core network function cloud native environment 1.10.0

oracle communications cloud native core service communication proxy 1.15.0

oracle communications cloud native core network repository function 1.15.1

oracle communications cloud native core binding support function 1.11.0

Vendor Advisories

Synopsis Moderate: Gatekeeper Operator v02 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Gatekeeper Operator v02Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available f ...
Synopsis Important: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Important Topic An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 12 (GitOps v122)Re ...
Synopsis Moderate: Release of OpenShift Serverless 1200 Type/Severity Security Advisory: Moderate Topic Release of OpenShift Serverless 1200Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available fo ...
Synopsis Moderate: Red Hat OpenShift distributed tracing 210 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Openshit distributed tracing 21Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: Release of containers for OSP 162 director operator tech preview Type/Severity Security Advisory: Important Topic Red Hat OpenStack Platform 162 (Train) director Operator containers areavailable for technology preview Description Release osp-director-operator imagesSecurity Fix(es): golang: net/http: limit growth of h ...
Synopsis Moderate: Red Hat Advanced Cluster Management 2211 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 2211 General Availability release images, which provide one or more container updates and bug fixesRed Hat Product Security has rated this update as ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 154 security update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 154 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score, whichg ...
A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP The highest threat from this vulnerability is to confidentiality (CVE-2021-33560) ...
A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP The highest threat from this vulnerability is to confidentiality (CVE-2021-33560) ...
Libgcrypt before 188 and 19x before 193 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately (There is also an interoperability problem because the selection of the k integer value does not properly consider the differences between ...
A weakness has been found in the generation of ephemeral keys in the ElGamal encryption of libgcrypt when the recipient's key is not generated using the same or a compatible implementation ...

Github Repositories

Tool to check whether a PGP client is affected by CVE-2021-33560

PGP client checker – CVE-2021-33560 This is a tool to check whether your OpenPGP client is affected by CVE-2021-33560 This vulnerability exposes to plaintext recovery the messages you encrypt to some ElGamal subkeys The technical details of the vulnerability are described in this blog post and this research article This tool tests whether your OpenPGP client is affect