p PatchFirst

CVE-2014-3591

CVE-2014-3591

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

CVSS 4.2 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libgcrypt

    Versions
    • before 1.6.3: Affected

    No fix published

  • gnupg

    Versions
    • before 1.4.19: Affected

    No fix published

  • libgcrypt20 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.6.3-2

    Update to 1.6.3-2

  • libgcrypt20 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.6.3-2

    Update to 1.6.3-2

  • libgcrypt20 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.6.3-2

    Update to 1.6.3-2

  • gnupg Ubuntu:14.04:LTS

    Versions
    • 1.4.14-1ubuntu2
    • 1.4.15-1.1ubuntu1
    • 1.4.15-1.1ubuntu2
    • 1.4.15-2ubuntu1
    • 1.4.16-1ubuntu1
    • 1.4.16-1ubuntu2
    • 1.4.16-1ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.4.16-1ubuntu2.3

    Update to 1.4.16-1ubuntu2.3

  • libgcrypt11 Ubuntu:14.04:LTS

    Versions
    • 1.5.0-3ubuntu3
    • 1.5.3-2ubuntu1
    • 1.5.3-2ubuntu4
    • 1.5.3-2ubuntu4.1
    Affected ranges
    • ECOSYSTEM: < 1.5.3-2ubuntu4.2

    Update to 1.5.3-2ubuntu4.2

  • libgcrypt20 Ubuntu:14.04:LTS

    Versions
    • 1.6.0-2
    • 1.6.0-2ubuntu2
    • 1.6.1-1
    • 1.6.1-2
    • 1.6.1-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.6.1-2ubuntu1.14.04.1

    Update to 1.6.1-2ubuntu1.14.04.1

Original sources

Check your server →