Information disclosure in GnuPG - CVE-2014-3591

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30571

Information disclosure in GnuPG - CVE-2014-3591

Published: November 29, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU30571
CSH Severity: Low
CVSS v4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3591
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.


Affected software

GnuPG
Amazon Linux AMI
Gentoo Linux
Fedora
Slackware Linux
gnupg1 (Alpine package)
gnupg
mingw-libgcrypt
libgcrypt

How to mitigate CVE-2014-3591

Install update from vendor's website.

GnuPG - update to 1.4.19
gnupg1 (Alpine package) - update to 1.4.19-r0
gnupg - addressed in versions 1.4.19-1.fc21, 1.4.19-1.fc22
mingw-libgcrypt - addressed in versions 1.6.3-1.el7, 1.6.3-1.fc21, 1.6.3-1.fc22
libgcrypt - addressed in versions 1.6.3-1.fc21, 1.6.3-1.fc22

External References

Related Security Bulletins