Summary
Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled
mixing functions in the random number generator. An attacker able to obtain
4640 bits from the RNG can trivially predict the next 160 bits of output.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | gnupg | 1.4.16-1ubuntu2.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | gnupg | 1.4.20-1ubuntu3.1 |
Vulnerabilities 1
-
Unscored —
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7…
References
-
report
https://ubuntu.com/security/CVE-2016-6313