The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4482 advisory.

    [1.8.5-4]
    - add PBKDF2 selftest for FIPS POST

    [1.8.5-3]
    - new upstream version 1.8.5
    - AES performance improvements backported from master branch
    - FIPS module is implicit with kernel FIPS flag
    - always run the FIPS selftests if FIPS module is installed

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libgcrypt packages installed that are affected by a vulnerability:

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libgcrypt fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete.

For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young <china@thewrittenword.com> for the report.

We recommend that you upgrade your libgcrypt20 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4482 advisory.

  - libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4236-1 advisory.

    It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use     this attack to recover sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and     1.6.3-2+deb8u4.(CVE-2019-13627)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-1018:01 advisory.

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
142776	Oracle Linux 8 : libgcrypt (ELSA-2020-4482)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/10/22	medium
147304	NewStart CGSL MAIN 6.02 : libgcrypt Vulnerability (NS-SA-2021-0071)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/10	medium
129337	openSUSE Security Update : libgcrypt (openSUSE-2019-2161)	Nessus	SuSE Local Security Checks	2019/9/25	2024/4/23	medium
129305	Debian DLA-1931-2 : libgcrypt20 regression update	Nessus	Debian Local Security Checks	2019/9/25	2024/4/23	medium
145939	CentOS 8 : libgcrypt (CESA-2020:4482)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	medium
132930	Ubuntu 18.04 LTS : Libgcrypt vulnerability (USN-4236-1)	Nessus	Ubuntu Local Security Checks	2020/1/15	2024/8/27	medium
130816	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	Nessus	Huawei Local Security Checks	2019/11/12	2022/5/18	medium
128679	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:2349-1)	Nessus	SuSE Local Security Checks	2019/9/11	2021/2/1	medium
184499	Rocky Linux 8 : libgcrypt (RLSA-2020:4482)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
294185	MiracleLinux 8 : libgcrypt-1.8.5-4.el8 (AXSA:2020-1018:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	2020/1/13	2022/5/18	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium