GnuPG reports :

Mitigate an ECDSA timing attack.

This update for libgcrypt fixes the following issues :

Security issues fixed :

  - CVE-2019-13627: Mitigation against an ECDSA timing     attack (bsc#1148987).

Bug fixes :

  - Added CMAC AES self test (bsc#1155339).

  - Added CMAC TDES self test missing (bsc#1155338).

  - Fix test dsa-rfc6979 in FIPS mode.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-1018:01 advisory.

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128439	FreeBSD : libgcrypt -- ECDSA timing attack (c9c6c2f8-cd54-11e9-af89-080027ef1a23)	Nessus	FreeBSD Local Security Checks	2019/9/3	2021/2/1	medium
132909	openSUSE Security Update : libgcrypt (openSUSE-2020-22)	Nessus	SuSE Local Security Checks	2020/1/15	2021/1/29	medium
157566	AlmaLinux 8 : libgcrypt (ALSA-2020:4482)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	medium
128679	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:2349-1)	Nessus	SuSE Local Security Checks	2019/9/11	2021/2/1	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	2020/1/13	2022/5/18	medium
184499	Rocky Linux 8 : libgcrypt (RLSA-2020:4482)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
294185	MiracleLinux 8 : libgcrypt-1.8.5-4.el8 (AXSA:2020-1018:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium