Input validation error in GnuPG - CVE-2015-0837

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33822

Input validation error in GnuPG - CVE-2015-0837

Published: November 29, 2019 / Updated: August 4, 2020


Vulnerability identifier: #VU33822
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-0837
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."


Affected software

GnuPG
Amazon Linux AMI
Gentoo Linux
Fedora
Ubuntu
Slackware Linux
gnupg1 (Alpine package)
libgcrypt11 (Ubuntu package)
gnupg (Ubuntu package)
libgcrypt20 (Ubuntu package)
gnupg2 (Ubuntu package)
gnupg
mingw-libgcrypt
libgcrypt

How to mitigate CVE-2015-0837

Install update from vendor's website.

GnuPG - update to 1.4.19
gnupg1 (Alpine package) - update to 1.4.19-r0
libgcrypt11 (Ubuntu package) - addressed in versions 1.4.4-5ubuntu2.4, 1.5.0-3ubuntu0.4, 1.5.3-2ubuntu4.2, 1.5.4-2ubuntu1.1
gnupg (Ubuntu package) - addressed in versions 1.4.10-2ubuntu1.8, 1.4.11-3ubuntu2.9, 1.4.16-1ubuntu2.3, 1.4.16-1.2ubuntu1.2
libgcrypt20 (Ubuntu package) - update to 1.6.1-2ubuntu1.14.10.1
gnupg2 (Ubuntu package) - addressed in versions 2.0.17-2ubuntu2.12.04.6, 2.0.22-3ubuntu1.3, 2.0.24-1ubuntu2.2
gnupg - addressed in versions 1.4.19-1.fc21, 1.4.19-1.fc22
mingw-libgcrypt - addressed in versions 1.6.3-1.el7, 1.6.3-1.fc21, 1.6.3-1.fc22
libgcrypt - addressed in versions 1.6.3-1.fc21, 1.6.3-1.fc22

External References

Related Security Bulletins