This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987).

Bug fixes: Added CMAC AES self test (bsc#1155339).

Added CMAC TDES self test missing (bsc#1155338).

Fix test dsa-rfc6979 in FIPS mode.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-32 (Libgcrypt: Side-channel attack)

    A timing attack was found in the way ECCDSA was implemented in       Libgcrypt.
  Impact :

    A local man-in-the-middle attacker, during signature generation, could       possibly recover the private key.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4482 advisory.

    The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.

    The following packages have been upgraded to a later upstream version: libgcrypt (1.8.5). (BZ#1764918)

    Security Fix(es):

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2020_4482 advisory.

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete.

For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young <china@thewrittenword.com> for the report.

We recommend that you upgrade your libgcrypt20 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and     1.6.3-2+deb8u4.(CVE-2019-13627)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4236-1 advisory.

    It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use     this attack to recover sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4482 advisory.

  - libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

GnuPG reports :

Mitigate an ECDSA timing attack.

This update for libgcrypt fixes the following issues :

Security issues fixed :

  - CVE-2019-13627: Mitigation against an ECDSA timing     attack (bsc#1148987).

Bug fixes :

  - Added CMAC AES self test (bsc#1155339).

  - Added CMAC TDES self test missing (bsc#1155338).

  - Fix test dsa-rfc6979 in FIPS mode.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-1018:01 advisory.

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
132432	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:3392-1)	Nessus	SuSE Local Security Checks	2019/12/30	2021/1/29	medium
134609	GLSA-202003-32 : Libgcrypt: Side-channel attack	Nessus	Gentoo Local Security Checks	2020/3/16	2020/10/16	medium
142393	RHEL 8 : libgcrypt (RHSA-2020:4482)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	medium
359262	Rocky Linux 8 [CIQ] Security Update: libgcrypt / libgcrypt-debuginfo / libgcrypt-debugsource / etc (crlsa-2020_4482)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
129305	Debian DLA-1931-2 : libgcrypt20 regression update	Nessus	Debian Local Security Checks	2019/9/25	2024/4/23	medium
130816	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	Nessus	Huawei Local Security Checks	2019/11/12	2022/5/18	medium
132930	Ubuntu 18.04 LTS : Libgcrypt vulnerability (USN-4236-1)	Nessus	Ubuntu Local Security Checks	2020/1/15	2024/8/27	medium
145939	CentOS 8 : libgcrypt (CESA-2020:4482)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	medium
128439	FreeBSD : libgcrypt -- ECDSA timing attack (c9c6c2f8-cd54-11e9-af89-080027ef1a23)	Nessus	FreeBSD Local Security Checks	2019/9/3	2021/2/1	medium
132909	openSUSE Security Update : libgcrypt (openSUSE-2020-22)	Nessus	SuSE Local Security Checks	2020/1/15	2021/1/29	medium
157566	AlmaLinux 8 : libgcrypt (ALSA-2020:4482)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	medium
294185	MiracleLinux 8 : libgcrypt-1.8.5-4.el8 (AXSA:2020-1018:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
184499	Rocky Linux 8 : libgcrypt (RLSA-2020:4482)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
128679	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:2349-1)	Nessus	SuSE Local Security Checks	2019/9/11	2021/2/1	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	2020/1/13	2022/5/18	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium