IM
IronMonkey Threat Research

CVE-2019-13627 MEDIUM

Published: 2019-09-25 | Last Modified: 2026-06-17 | Status: Modified

Description

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

Additional Descriptions (1)

Se detectó que había un ataque de sincronización ECDSA en la biblioteca criptográfica libgcrypt20. Versión afectada: 1.8.4-5, 1.7.6-2+deb9u3 y 1.6.3-2+deb8u4. Versiones corregidas: 1.8.5-2 y 1.6.3-2+deb8u7.

CVSS Metrics

Base Score: 6.3 (MEDIUM)

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.0

Impact Score: 5.2

Base Score: 2.6 (LOW)

AV:L/AC:H/Au:N/C:P/I:P/A:N

Access VectorLOCAL
Access ComplexityHIGH
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.9

Impact Score: 4.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-203

Affected Products

Vendor Product Version Update Type
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd341bebe00> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd341beaac0> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd2dbc44840> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd341be9380> Operating System
canonical ubuntu_linux 19.04 <built-in method update of dict object at 0x7fd341be8c40> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x7fd341be8dc0> Operating System
opensuse leap 15.0 <built-in method update of dict object at 0x7fd36b5e33c0> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x7fd341beb200> Operating System
libgcrypt20_project libgcrypt20 1.6.3-2\+deb8u4 <built-in method update of dict object at 0x7fd2a2df9400> Application
libgcrypt20_project libgcrypt20 1.7.6-2\+deb9u3 <built-in method update of dict object at 0x7fd341be9640> Application
libgcrypt20_project libgcrypt20 1.8.4-5 <built-in method update of dict object at 0x7fd2dbc472c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.6.3-2\+deb8u4:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.7.6-2\+deb9u3:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.8.4-5:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References