Cryptographic issues in Libgcrypt - CVE-2019-13627

Vulnerability identifier: #VU24721

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13627

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform timing attack.

The vulnerability exists due to an error within the libgcrypt20 cryptographic library. A remote attacker can perform ECDSA timing attack.

Libgcrypt
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
Service Telemetry Framework
libgcrypt (Alpine package)
libgcrypt (Red Hat package)
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Tivoli Storage Manager
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install updates from vendor's website.

Libgcrypt - update to 1.8.5
libgcrypt (Alpine package) - update to 1.8.3-r2
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0, 1.12.0
Quay - update to 3.3.3
libgcrypt (Red Hat package) - update to 1.8.5-4.el8
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity XT Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity Operating Environment (OE) - update to 5.0.2.0.5.009

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html
• http://www.openwall.com/lists/oss-security/2019/10/02/2
• https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5
• https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html
• https://minerva.crocs.fi.muni.cz/
• https://security-tracker.debian.org/tracker/CVE-2019-13627

• Timing attack in libgcrypt
• OpenSUSE Linux update for libgcrypt
• OpenSUSE Linux update for libgcrypt
• Gentoo update for Libgcrypt
• Cryptographic issues in libgcrypt (Alpine package)
• Red Hat Enterprise Linux 8 update for libgcrypt
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in Dell EMC Unity Family, Dell EMC Unity XT Family