Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33560: A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP. The highest threat from this vulnerability is to confidentiality.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libgcrypt | 0:1.5.3-14.amzn2.0.3 |
| Amazon Linux · 2 | libgcrypt-debuginfo | 0:1.5.3-14.amzn2.0.3 |
| Amazon Linux · 2 | libgcrypt-devel | 0:1.5.3-14.amzn2.0.3 |
Vulnerabilities 1
-
High 7.5CVE-2021-33560 Public exploit
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to addre…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-33560.html