Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Libgcrypt versiones anteriores a 1.8.8 y versiones 1.9.x anteriores a 1.9.3, maneja inapropiadamente el cifrado de ElGamal porque carece de cegado de exponentes para hacer frente a un ataque de canal lateral contra la función mpi_powm, y el tamaño de la ventana no se elige apropiadamente. Esto, por ejemplo, afecta el uso de ElGamal en OpenPGP.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-203
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-325
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnupg | libgcrypt | * | <built-in method update of dict object at 0x7fd2dbd9db00> | Application |
| gnupg | libgcrypt | * | <built-in method update of dict object at 0x7fd36945d680> | Application |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd2dbd9c1c0> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd2dbd9f6c0> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd2dbd9dd40> | Operating System |
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 | <built-in method update of dict object at 0x7fd2dbd9ce40> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.9.0 | <built-in method update of dict object at 0x7fd3e4f65000> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x7fd2dbe953c0> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.14.0 | <built-in method update of dict object at 0x7fd39c4e4d80> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.0 | <built-in method update of dict object at 0x7fd2dbd9e680> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 1.15.1 | <built-in method update of dict object at 0x7fd2dbd9dbc0> | Application |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | <built-in method update of dict object at 0x7fd2dbe97c80> | Application |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.15.0 | <built-in method update of dict object at 0x7fd36a003300> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* |