Not rated
CVE-2018-0495 Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be…
Description
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- git.gnupg.org git.gnupg.org
- 1041144 www.securitytracker.com
- USN-3850-1 usn.ubuntu.com
- 1041147 www.securitytracker.com
- www.nccgroup.trust www.nccgroup.trust
- USN-3689-1 usn.ubuntu.com
- lists.gnupg.org lists.gnupg.org
- USN-3689-2 usn.ubuntu.com
- USN-3692-2 usn.ubuntu.com
- [debian-lts-announce] 20180629 [SECURITY] [DLA 1405-1] libgcrypt20 security update lists.debian.org
- DSA-4231 www.debian.org
- RHSA-2018:3505 access.redhat.com
- USN-3850-2 usn.ubuntu.com
- USN-3692-1 usn.ubuntu.com
- RHSA-2018:3221 access.redhat.com
- dev.gnupg.org dev.gnupg.org
- www.oracle.com www.oracle.com
- RHSA-2019:1297 access.redhat.com
- RHSA-2019:1296 access.redhat.com
- RHSA-2019:1543 access.redhat.com
- RHSA-2019:2237 access.redhat.com
Timeline
- Published
- Last modified