VulnerabilityModified
CVE-2014-3591
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the…
MEDIUM 4.2EPSS 0.58%
Does this matter?
Lower severity and a low EPSS score (0.58%). Track it; it rarely justifies an emergency change on its own.
Description
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
- CVSS 3.1
- 4.2 MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- gnupg/gnupg · gnupg/libgcrypt · debian/debian linux
- Source
- secalert@redhat.com
References
- http://www.cs.tau.ac.il/~tromer/radioexp/Third Party Advisory
- http://www.debian.org/security/2015/dsa-3184Third Party Advisory
- http://www.debian.org/security/2015/dsa-3185Third Party Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.htmlPatch, Release Notes, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.htmlPatch, Vendor Advisory
- http://www.cs.tau.ac.il/~tromer/radioexp/Third Party Advisory
- http://www.debian.org/security/2015/dsa-3184Third Party Advisory
- http://www.debian.org/security/2015/dsa-3185Third Party Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.htmlPatch, Release Notes, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.htmlPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.