PT-2017-18992 · Gnu+3 · Libgcrypt+3

Published 2017-06-10 · Updated 2019-01-16 · CVE-2017-9526

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Libgcrypt versions prior to 1.7.7

Description The issue allows an attacker who obtains the EdDSA session key, potentially through side-channel observation during the signing process, to easily recover the long-term secret key. This is addressed by storing the session key in secure memory and ensuring constant-time point operations are used in the MPI library.

Recommendations For versions prior to 1.7.7, update to version 1.7.7 or later to ensure the session key is stored in secure memory and to utilize constant-time point operations in the MPI library.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1869

CVE-2017-9526

DSA-3880-1

SUSE-SU-2017:1608-1

SUSE-SU-2017_1608-1

USN-3347-1

Affected Products

Alt Linux

Libgcrypt

Suse

Ubuntu

References · 34

• https://bdu.fstec.ru/vul/2018-00007 · Security Note
• https://ubuntu.com/security/notices/USN-3347-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9526 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9526 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libgcrypt20 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1608-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9526 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3880-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3880 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-9526 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1869 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3880-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9526 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526 · Security Note
• https://osv.dev/vulnerability/USN-3347-1 · Vendor Advisory