Multiple vulnerabilities have been found in libgcrypt, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libgcrypt | * | < 1.9.4 | >= 1.9.4 |
libgcrypt is a general purpose cryptographic library derived out of GnuPG.
Multiple vulnerabilities have been discovered in libgcrypt. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.9.4"
A vulnerability in Libgcrypt could allow a local attacker to recover sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libgcrypt | * | < 1.8.5 | >= 1.8.5 |
Libgcrypt is a general purpose cryptographic library derived out of GnuPG.
A timing attack was found in the way ECCDSA was implemented in Libgcrypt.
A local man-in-the-middle attacker, during signature generation, could possibly recover the private key.
There is no known workaround at this time.
All Libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.8.5"
Multiple vulnerabilities have been fixed in libgcrypt,the worst of which results in predictable output from the random number generator.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libgcrypt | * | < 1.7.3 | >= 1.7.3 |
libgcrypt is a general purpose cryptographic library derived out of GnuPG.
Multiple vulnerabilities have been discovered in libgcrypt. Please review the CVE identifiers referenced below for details.
Side-channel attacks can leak private key information. A separate critical bug allows an attacker who obtains 4640 bits from the RNG to trivially predict the next 160 bits of output.
There is no known workaround at this time.
All libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.7.3"
Multiple vulnerabilities have been found in GnuPG and libgcrypt, the worst of which may allow a local attacker to obtain confidential key information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/gnupg | * | < 2.0.26-r3 | >= 2.0.26-r3, >= 1.4.19 (revision), >= 1.4.20 (revision), >= 1.4.21 (revision), >= 1.4.22 (revision) |
| dev-libs/libgcrypt | * | < 1.6.3-r4 | >= 1.6.3-r4 |
The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software.
Multiple vulnerabilities have been discovered in GnuPG and libgcrypt, please review the CVE identifiers referenced below for details.
A local attacker could possibly cause a Denial of Service condition. Side-channel attacks could be leveraged to obtain key material.
There is no known workaround at this time.
All GnuPG 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-2.0.26-r3"
All GnuPG 1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-1.4.19"
All libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.6.3-r4"
A vulnerability in Libgcrypt could allow a remote attacker to extract ElGamal private key information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libgcrypt | * | < 1.5.4 | >= 1.5.4 |
Libgcrypt is a general purpose cryptographic library derived out of GnuPG.
A vulnerability in the implementation of ElGamal decryption procedures of Libgcrypt leaks information to various side-channels.
A physical side-channel attack allows a remote attacker to fully extract decryption keys during the decryption of a chosen ciphertext.
There is no known workaround at this time.
All Libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.5.4"
Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt, which may result in execution of arbitrary code, Denial of Service, or the disclosure of private keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/gnupg | * | < 2.0.22 | >= 2.0.22, >= 1.4.16 (revision), >= 1.4.17 (revision), >= 1.4.18 (revision), >= 1.4.19 (revision), >= 1.4.20 (revision), >= 1.4.21 (revision) |
| dev-libs/libgcrypt | * | < 1.5.3 | >= 1.5.3 |
The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Libgcrypt is a cryptographic library based on GnuPG.
Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt. Please review the CVE identifiers referenced below for details.
An unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the user running GnuPG, cause a Denial of Service condition, or bypass security restrictions. Additionally, a side-channel attack may allow a local attacker to recover a private key, please review “Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack” in the References section for further details.
There is no known workaround at this time.
All GnuPG 2.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-2.0.22"
All GnuPG 1.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-1.4.16"
All Libgcrypt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.5.3"