Skip to content
OpenAdvisories
Unscored CVE-2014-5270 EUVD-2014-5163GHSA-47gj-9v97-r4c7

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomizatio…

Published Oct 10, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Package: libgcrypt11 Package: libgcrypt20 Ecosystem: Debian Ecosystem: Ubuntu

Description

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libgcrypt20 1.6.0-2 —
Debian 13 libgcrypt20 1.6.0-2 —
Debian 12 libgcrypt20 1.6.0-2 —
Debian 7 gnupg 1.4.12-7+deb7u6 DSA-3024-1
Debian 7 libgcrypt11 1.5.0-5+deb7u2 DSA-3073-1
Debian 6.0 gnupg 1.4.10-4+squeeze6 DLA-54-1
Debian 6.0 libgcrypt11 1.4.5-2+squeeze2 DLA-93-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS gnupg 1.4.16-1ubuntu2.3 USN-2554-1
Ubuntu 14.04 LTS gnupg2 2.0.22-3ubuntu1.3 USN-2554-1
Ubuntu 14.04 LTS libgcrypt11 1.5.3-2ubuntu4.1 USN-2339-2

Advisories 6

References