CVE-2013-4242
Fixed in a distro release EPSS <1%
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Products: canonical ubuntu_linux, debian_linux, gnupg, gnupg libgcrypt, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | gnupg | 1.4.10-4+squeeze2 |
| Debian 6.0 | libgcrypt11 | 1.4.5-2+squeeze1 |
| Debian 7 | gnupg | 1.4.12-7+deb7u1 |
| Debian 7 | libgcrypt11 | 1.5.0-5+deb7u1 |
| Red Hat Enterprise Linux 5 | gnupg | 0:1.4.5-18.el5_10 |
| Red Hat Enterprise Linux 5 | gnupg-debuginfo | 0:1.4.5-18.el5_10 |
| Red Hat Enterprise Linux 5 | libgcrypt | 0:1.4.4-7.el5_10 |
| Red Hat Enterprise Linux 5 | libgcrypt-debuginfo | 0:1.4.4-7.el5_10 |
| Red Hat Enterprise Linux 5 | libgcrypt-devel | 0:1.4.4-7.el5_10 |
| Red Hat Enterprise Linux 6 | libgcrypt | 0:1.4.5-11.el6_4 |
| Red Hat Enterprise Linux 6 | libgcrypt-debuginfo | 0:1.4.5-11.el6_4 |
| Red Hat Enterprise Linux 6 | libgcrypt-devel | 0:1.4.5-11.el6_4 |
| openSUSE Tumbleweed | libgcrypt | 1.7.3-1.3 |