PT-2015-4906 · Gnu+3 · Libgcrypt+4

Yuval Yarum · Publicado 2015-03-02 · Atualizado 2024-06-15 · CVE-2015-0837

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Libgcrypt versions prior to 1.6.3 GnuPG versions prior to 1.4.19

Description The issue allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack." This occurs in the mpi powm function.

Recommendations For Libgcrypt versions prior to 1.6.3, update to version 1.6.3 or later. For GnuPG versions prior to 1.4.19, update to version 1.4.19 or later.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

ALT-PU-2015-1541

ALT-PU-2015-2052

CVE-2015-0837

DLA-175-1

DLA-190-1

DSA-3184-1

DSA-3185-1

MGASA-2015-0104

MGASA-2015-0360

OPENSUSE-SU-2024:10037-1

SUSE-SU-2015:1511-1

SUSE-SU-2015:1626-1

SUSE-SU-2015_1511-1

USN-2554-1

USN-2555-1

Produtos afetados

Alt Linux

Gnupg

Libgcrypt

Suse

Ubuntu

Referências · 62

• https://suse.com/security/cve/CVE-2015-5738 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2015:1511-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-1607 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2015-2052 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-0837.html · Nota
• https://osv.dev/vulnerability/MGASA-2015-0104 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1607 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2015-0360.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-1606 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3184-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-0837 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-7511 · Nota
• https://ubuntu.com/security/CVE-2014-3591 · Aviso do Fabricante
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1606 · Nota de Segurança