Homepage
About Snyk

Information Exposure Affecting libgcrypt20 package, versions <1.6.5-2ubuntu0.3

low

Snyk CVSS

    Attack Complexity High
    Confidentiality High

    Threat Intelligence

    EPSS 0.4% (74th percentile)
Expand this section
NVD
5.9 medium
Expand this section
Red Hat
5.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-UBUNTU1604-LIBGCRYPT20-391869
  • published 11 Jun 2017
  • disclosed 11 Jun 2017
Report a new vulnerability Found a mistake?

Introduced: 11 Jun 2017

CVE-2017-9526 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade Ubuntu:16.04 libgcrypt20 to version 1.6.5-2ubuntu0.3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. See How to fix? for Ubuntu:16.04 relevant fixed versions and status.

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

References