CVEvulnerability
CVE-2014-3591
4.2 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-11-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.2 MEDIUM — CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
Affected configurations
• gnupg gnupg (< 1.4.19)
• gnupg libgcrypt (< 1.6.3)
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.cs.tau.ac.il/~tromer/radioexp/ Third Party Advisory
- http://www.debian.org/security/2015/dsa-3184 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3185 Third Party Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html Patch, Release Notes, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html Patch, Vendor Advisory
- http://www.cs.tau.ac.il/~tromer/radioexp/ Third Party Advisory
- http://www.debian.org/security/2015/dsa-3184 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3185 Third Party Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html Patch, Release Notes, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html Patch, Vendor Advisory