PT-2021-6020 · Libgcrypt+9 · Libgcrypt+9

Alessandro Sorniotti + 2 · Published 2021-06-24 · Updated 2025-06-11 · CVE-2021-40528

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Libgcrypt versions prior to 1.9.4

Description The issue is related to the use of a weak cryptographic algorithm in the Libgcrypt library. It affects the ElGamal implementation, allowing plaintext recovery due to a dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents. This can lead to a cross-configuration attack against OpenPGP.

Recommendations For Libgcrypt versions prior to 1.9.4, update to version 1.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ElGamal implementation until a patch is available.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

ALSA-2022:5311

ALT-PU-2021-3312

ALT-PU-2024-11176

ALT-PU-2024-8930

ALT-PU-2025-7372

BDU:2022-00593

CESA-2022_5311

CVE-2021-40528

DLA-2691-1

MGASA-2021-0446

OESA-2021-1362

OPENSUSE-SU-2024:12540-1

RHSA-2022:5311

RHSA-2022_5311

RLSA-2022:5311

USN-5080-1

USN-5080-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Libgcrypt

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 46

• 🔥 https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 · Exploit
• https://advisories.mageia.org/MGASA-2021-0446.html · Security Note
• https://bdu.fstec.ru/vul/2022-00593 · Security Note
• https://osv.dev/vulnerability/USN-5080-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5080-2 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:5311 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40528 · Security Note
• https://ubuntu.com/security/CVE-2021-33560 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40528 · Security Note
• https://ubuntu.com/security/CVE-2021-40528 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1362 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40528 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-5311.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2691-1 · Vendor Advisory