The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5080-1 advisory.

    It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use     this issue to recover sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-13 (libgcrypt: Multiple Vulnerabilities)

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

  - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction     between two cryptographic libraries, a certain dangerous combination of the prime defined by the     receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral     exponents can lead to a cross-configuration attack against OpenPGP. (CVE-2021-40528)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction     between two cryptographic libraries, a certain dangerous combination of the prime defined by the     receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral     exponents can lead to a cross-configuration attack against OpenPGP. (CVE-2021-40528)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2691 advisory.

    An issue has been found in libgcrypt20, a crypto library. Mishandling of ElGamal encryption results in a     possible side-channel attack and an interoperability problem with keys not generated by GnuPG/libgcrypt.
    For Debian 9 stretch, this problem has been fixed in version 1.7.6-2+deb9u4. We recommend that you upgrade     your libgcrypt20 packages. For the detailed security status of libgcrypt20 please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/libgcrypt20 Further information about Debian     LTS security advisories, how to apply these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5080-2 advisory.

    USN-5080-1 fixed several vulnerabilities in Libgcrypt. This update provides the corresponding update for     Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
153447	Ubuntu 18.04 LTS / 20.04 LTS : Libgcrypt vulnerabilities (USN-5080-1)	Nessus	Ubuntu Local Security Checks	2021/9/16	2024/9/19	critical
166722	GLSA-202210-13 : libgcrypt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	high
158365	EulerOS 2.0 SP10 : libgcrypt (EulerOS-SA-2022-1209)	Nessus	Huawei Local Security Checks	2022/2/25	2023/11/7	medium
151006	Debian DLA-2691-1 : libgcrypt20 - LTS security update	Nessus	Debian Local Security Checks	2021/6/25	2025/1/24	critical
153514	Ubuntu 16.04 ESM : Libgcrypt vulnerabilities (USN-5080-2)	Nessus	Ubuntu Local Security Checks	2021/9/21	2024/10/30	critical

检测

插件搜索

critical

high

medium

critical

critical