CVE-2017-7526
Fixed in a distro release EPSS 4%CVSS 6.1
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
Products: GnuPG libgcrypt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | gnupg1 | 1.4.23-r0 |
| Alpine 3.11 | gnupg1 | 1.4.23-r0 |
| Alpine 3.12 | gnupg1 | 1.4.23-r0 |
| Alpine 3.5 | gnupg1 | 1.4.23-r0 |
| Alpine 3.6 | gnupg1 | 1.4.23-r0 |
| Alpine 3.7 | gnupg1 | 1.4.23-r0 |
| Alpine 3.8 | gnupg1 | 1.4.23-r0 |
| Alpine 3.9 | gnupg1 | 1.4.23-r0 |
| Arch Linux | libgcrypt | 1.7.8-1 |
| Debian 12 | gnupg1 | 1.4.22-1 |
| Debian 12 | libgcrypt20 | 1.7.8-1 |
| Debian 13 | gnupg1 | 1.4.22-1 |
| Debian 13 | libgcrypt20 | 1.7.8-1 |
| Debian 14 | gnupg1 | 1.4.22-1 |
| Debian 14 | libgcrypt20 | 1.7.8-1 |
| Debian 7 | gnupg | 1.4.12-7+deb7u9 |
| Debian 7 | libgcrypt11 | 1.5.0-5+deb7u6 |
| Debian 8 | gnupg | 1.4.18-7+deb8u4 |
| Debian 8 | libgcrypt20 | 1.6.3-2+deb8u4 |
| Debian 9 | libgcrypt20 | 1.7.6-2+deb9u1 |
| SUSE Linux Enterprise Desktop 12 SP2 | libgcrypt | 1.6.1-16.42.1 |
| SUSE Linux Enterprise Module for Legacy 12 | compat-libgcrypt11 | 1.5.0-0.6.1 |
| SUSE Linux Enterprise Server 11 SP4 | libgcrypt | 1.5.0-0.25.1 |
| SUSE Linux Enterprise Server 12 SP2 | libgcrypt | 1.6.1-16.42.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | libgcrypt | 1.6.1-16.42.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libgcrypt | 1.5.0-0.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | libgcrypt | 1.6.1-16.42.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libgcrypt | 1.5.0-0.25.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | libgcrypt | 1.6.1-16.42.1 |
| Ubuntu 14.04 LTS | gnupg | 1.4.16-1ubuntu2.6 |
| Ubuntu 14.04 LTS | libgcrypt11 | 1.5.3-2ubuntu4.5 |
| Ubuntu 16.04 LTS | gnupg | 1.4.20-1ubuntu3.3 |
| Ubuntu 16.04 LTS | libgcrypt20 | 1.6.5-2ubuntu0.3 |
| openSUSE Tumbleweed | libgcrypt | 1.9.4-1.2 |