PT-2017-18992 · Gnu+3 · Libgcrypt+3
Publicado
2017-06-10
·
Atualizado
2019-01-16
·
CVE-2017-9526
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Libgcrypt versions prior to 1.7.7
Description
The issue allows an attacker who obtains the EdDSA session key, potentially through side-channel observation during the signing process, to easily recover the long-term secret key. This is addressed by storing the session key in secure memory and ensuring constant-time point operations are used in the MPI library.
Recommendations
For versions prior to 1.7.7, update to version 1.7.7 or later to ensure the session key is stored in secure memory and to utilize constant-time point operations in the MPI library.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Libgcrypt
Suse
Ubuntu