p PatchFirst

CVE-2024-2236

CVE-2024-2236 · Libgcrypt: vulnerable to marvin attack

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

CVSS 5.9 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 9

    Versions
    • ≥ 0:1.10.0-11.el9: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.2 extended update support

    Versions
    • ≥ 0:1.10.0-10.el9_2.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.4 extended update support

    Versions
    • ≥ 0:1.10.0-10.el9_4.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • libgcrypt20 Debian:12

    Versions
    • 1.10.1-3
    • 1.10.1-3+deb12u1
    • 1.10.2-1
    • 1.10.2-2
    • 1.10.2-2+loong64
    • 1.10.2-3
    • 1.10.3-1
    • 1.10.3-2
    • 1.10.3-3
    • 1.11.0+git20250114-1
    • 1.11.0-1
    • 1.11.0-2
    • 1.11.0-3
    • 1.11.0-4
    • 1.11.0-5
    • 1.11.0-6
    • 1.11.0-7
    • 1.11.0~beta450-1
    • 1.11.1-1
    • 1.11.2-1
    • 1.11.2-2
    • 1.11.2-3
    • 1.12.0-1
    • 1.12.0-2
    • 1.12.1-1
    • 1.12.1-2
    • 1.12.2-1
    • 1.12.3-1
    • 1.12.3-2
    • 1.12.4-1
    • 1.12.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Debian:13

    Versions
    • 1.11.0+git20250114-1
    • 1.11.0-7
    • 1.11.0-7+deb13u1
    • 1.11.1-1
    • 1.11.2-1
    • 1.11.2-2
    • 1.11.2-3
    • 1.12.0-1
    • 1.12.0-2
    • 1.12.1-1
    • 1.12.1-2
    • 1.12.2-1
    • 1.12.3-1
    • 1.12.3-2
    • 1.12.4-1
    • 1.12.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Debian:14

    Versions
    • 1.11.0+git20250114-1
    • 1.11.0-7
    • 1.11.1-1
    • 1.11.2-1
    • 1.11.2-2
    • 1.11.2-3
    • 1.12.0-1
    • 1.12.0-2
    • 1.12.1-1
    • 1.12.1-2
    • 1.12.2-1
    • 1.12.3-1
    • 1.12.3-2
    • 1.12.4-1
    • 1.12.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt11 Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.0-3ubuntu3
    • 1.5.3-2ubuntu1
    • 1.5.3-2ubuntu4
    • 1.5.3-2ubuntu4.1
    • 1.5.3-2ubuntu4.2
    • 1.5.3-2ubuntu4.3
    • 1.5.3-2ubuntu4.4
    • 1.5.3-2ubuntu4.5
    • 1.5.3-2ubuntu4.6
    • 1.5.3-2ubuntu4.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.6.3-2ubuntu1
    • 1.6.4-3
    • 1.6.4-4
    • 1.6.4-5
    • 1.6.5-2
    • 1.6.5-2ubuntu0.2
    • 1.6.5-2ubuntu0.3
    • 1.6.5-2ubuntu0.4
    • 1.6.5-2ubuntu0.5
    • 1.6.5-2ubuntu0.6
    • 1.6.5-2ubuntu0.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:18.04:LTS

    Versions
    • 1.7.8-2ubuntu1
    • 1.7.9-1
    • 1.8.1-4
    • 1.8.1-4ubuntu1
    • 1.8.1-4ubuntu1.1
    • 1.8.1-4ubuntu1.2
    • 1.8.1-4ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:18.04:LTS

    Versions
    • 1.8.1-4ubuntu1.fips.2.4
    • 1.8.1-4ubuntu1.fips.2.5
    • 1.8.1-4ubuntu1.fips.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:FIPS:18.04:LTS

    Versions
    • 1.8.1-4ubuntu1.fips.2.4
    • 1.8.1-4ubuntu1.fips.2.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:20.04:LTS

    Versions
    • 1.8.4-5ubuntu2
    • 1.8.5-3ubuntu1
    • 1.8.5-5ubuntu1
    • 1.8.5-5ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:20.04:LTS

    Versions
    • 1.8.5-5ubuntu1.fips.1.1
    • 1.8.5-5ubuntu1.fips.1.4
    • 1.8.5-5ubuntu1.fips.1.5
    • 1.8.5-5ubuntu1.fips.1.7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:FIPS:20.04:LTS

    Versions
    • 1.8.5-5ubuntu1.fips.1.1
    • 1.8.5-5ubuntu1.fips.1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:22.04:LTS

    Versions
    • 1.8.7-5ubuntu2
    • 1.9.4-3ubuntu2
    • 1.9.4-3ubuntu3
    • 1.9.4-3ubuntu3.2
    Affected ranges
    • ECOSYSTEM: < 1.9.4-3ubuntu3.3

    Update to 1.9.4-3ubuntu3.3

  • libgcrypt20 Ubuntu:Pro:FIPS-preview:22.04:LTS

    Versions
    • 1.9.4-3ubuntu3+Fips1.1
    • 1.9.4-3ubuntu3+Fips1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:22.04:LTS

    Versions
    • 1.9.4-3ubuntu3+Fips1.1
    • 1.9.4-3ubuntu3+Fips1.2
    • 1.9.4-3ubuntu3+Fips1.3
    • 1.9.4-3ubuntu3+Fips1.4
    • 1.9.4-3ubuntu3.2+Fips1
    Affected ranges
    • ECOSYSTEM: < 1.9.4-3ubuntu3.3+Fips1

    Update to 1.9.4-3ubuntu3.3+Fips1

  • libgcrypt20 Ubuntu:24.04:LTS

    Versions
    • 1.10.2-3ubuntu1
    • 1.10.3-2
    • 1.10.3-2build1
    • 1.10.3-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.10.3-2ubuntu0.2

    Update to 1.10.3-2ubuntu0.2

  • libgcrypt20 Ubuntu:Pro:FIPS-updates:24.04:LTS

    Versions
    • 1.10.3-2ubuntu0.1~Fips1~rc6
    • 1.10.3-2ubuntu0.1~Fips1~rc7
    • 1.12.0-2ubuntu0.1~Fips1~rc11
    Affected ranges
    • ECOSYSTEM: < 1.12.0-2ubuntu1.1+Fips2

    Update to 1.12.0-2ubuntu1.1+Fips2

  • libgcrypt20 Ubuntu:25.10

    Versions
    • 1.11.0-6ubuntu1
    • 1.11.0-7
    • 1.11.0-7build1
    • 1.11.0-7ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →