6.1
Medium
CVE-2017-7526 libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of…
Description
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libgcrypt | 1.7.8 | No fix stated |
References
- USN-3733-1 usn.ubuntu.com
- bugzilla.redhat.com bugzilla.redhat.com
- 1038915 www.securitytracker.com
- DSA-3960 www.debian.org
- git.gnupg.org git.gnupg.org
- DSA-3901 www.debian.org
- USN-3733-2 usn.ubuntu.com
- eprint.iacr.org eprint.iacr.org
- 99338 www.securityfocus.com
- [gnupg-announce] 20170629 Libgcrypt 1.7.8 released to fix CVE-2017-7526 lists.gnupg.org
- git.gnupg.org git.gnupg.org
- git.gnupg.org git.gnupg.org
Timeline
- Published
- Last modified