PT-2024-2174 · Libgcrypt +4 · Libgcrypt +4

Robb Gatica

·

Published

2024-03-06

·

Updated

2025-08-07

·

CVE-2024-2236

Report an issue
CVSS v3.1
5.9
VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

libgcrypt (affected versions not specified)

Description:

A timing-based side-channel flaw was found in libgcrypt's RSA implementation, which may allow a remote attacker to initiate a Bleichenbacher-style attack. This can lead to the decryption of RSA ciphertexts. The issue is related to insufficient protection of service data due to timing discrepancies, potentially enabling a remote attacker to perform a Bleichenbacher or Marvin attack.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-208CWE-385

Related Identifiers

ALSA-2024:9404
BDU:2024-02088
CVE-2024-2236
INFSA-2024_9404
RHSA-2024:9404
RHSA-2024_9404
RHSA-2025:3530
RHSA-2025:3534
RLSA-2024:9404
SUSE-SU-2025:02447-1
SUSE-SU-2025:02464-2
SUSE-SU-2025:02719-1

Affected Products

Almalinux
Debian
Red Hat
Rocky Linux
Libgcrypt