p PatchFirst

CVE-2021-40528

CVE-2021-40528

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

CVSS 5.9 · Medium · EPSS 1.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • libgcrypt20 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.8.7-6

    Update to 1.8.7-6

  • libgcrypt20 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.7-6

    Update to 1.8.7-6

  • libgcrypt20 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.8.7-6

    Update to 1.8.7-6

  • libgcrypt20 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.6.3-2ubuntu1
    • 1.6.4-3
    • 1.6.4-4
    • 1.6.4-5
    • 1.6.5-2
    • 1.6.5-2ubuntu0.2
    • 1.6.5-2ubuntu0.3
    • 1.6.5-2ubuntu0.4
    • 1.6.5-2ubuntu0.5
    • 1.6.5-2ubuntu0.6
    Affected ranges
    • ECOSYSTEM: < 1.6.5-2ubuntu0.6+esm1

    Update to 1.6.5-2ubuntu0.6+esm1

  • libgcrypt20 Ubuntu:18.04:LTS

    Versions
    • 1.7.8-2ubuntu1
    • 1.7.9-1
    • 1.8.1-4
    • 1.8.1-4ubuntu1
    • 1.8.1-4ubuntu1.1
    • 1.8.1-4ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 1.8.1-4ubuntu1.3

    Update to 1.8.1-4ubuntu1.3

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:18.04:LTS

    Versions
    • 1.8.1-4ubuntu1.fips.2.4
    • 1.8.1-4ubuntu1.fips.2.5
    Affected ranges
    • ECOSYSTEM: < 1.8.1-4ubuntu1.fips.3

    Update to 1.8.1-4ubuntu1.fips.3

  • libgcrypt20 Ubuntu:Pro:FIPS:18.04:LTS

    Versions
    • 1.8.1-4ubuntu1.fips.2.4
    • 1.8.1-4ubuntu1.fips.2.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:20.04:LTS

    Versions
    • 1.8.4-5ubuntu2
    • 1.8.5-3ubuntu1
    • 1.8.5-5ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.8.5-5ubuntu1.1

    Update to 1.8.5-5ubuntu1.1

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:20.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.8.5-5ubuntu1.fips.1.1

    Update to 1.8.5-5ubuntu1.fips.1.1

  • libgcrypt20 Ubuntu:Pro:FIPS:20.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.8.5-5ubuntu1.fips.1.1

    Update to 1.8.5-5ubuntu1.fips.1.1

  • libgcrypt20 Ubuntu:22.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.8.7-5ubuntu2

    Update to 1.8.7-5ubuntu2

Original sources

Check your server →