PT-2017-3251 · Gnu+4 · Libgcrypt+4

Christine Van Vredendaal + 7 · Published 2017-06-29 · Updated 2024-06-15 · CVE-2017-7526

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libgcrypt versions prior to 1.7.8

Description The issue is related to a cache side-channel attack that can lead to a complete break of RSA-1024 and potentially RSA-2048 with increased computation. This attack requires the ability to run arbitrary software on the hardware where the private RSA key is used, allowing a local attacker to compromise data confidentiality by fully recovering the RSA key using the left-to-right method for computing the sliding-window expansion.

Recommendations For libgcrypt versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-310

CWE-200

Related Identifiers

ALT-PU-2017-1818

ALT-PU-2017-1869

ALT-PU-2017-2769

ALT-PU-2018-2426

AZL-41702

BDU:2018-00007

CVE-2017-7526

DLA-1015-1

DLA-1080-1

DSA-3901-1

DSA-3960-1

MGASA-2017-0213

MGASA-2017-0235

OPENSUSE-SU-2024:10941-1

SUSE-SU-2017:1793-1

SUSE-SU-2017:1794-1

SUSE-SU-2017:1866-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_1793-1

SUSE-SU-2017_1794-1

SUSE-SU-2017_1866-1

USN-3347-1

USN-3347-2

USN-3733-1

USN-3733-2

Affected Products

Alt Linux

Astra Linux

Suse

Ubuntu

Libgcrypt

References · 60

• https://osv.dev/vulnerability/MGASA-2017-0213 · Vendor Advisory
• https://usn.ubuntu.com/3733-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7526 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7526 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3733-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://usn.ubuntu.com/3733-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9526 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3733-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3960-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3901-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1866-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7526 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7526 · Vendor Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html · Vendor Advisory