VulnerabilityModified
CVE-2016-6313
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640…
MEDIUM 5.3EPSS 3.60%
Does this matter?
Lower severity and a low EPSS score (3.60%). Track it; it rarely justifies an emergency change on its own.
Description
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 3.60% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- gnupg/libgcrypt · debian/debian linux · canonical/ubuntu linux · gnupg/gnupg
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2016-2674.html
- http://www.debian.org/security/2016/dsa-3649Third Party Advisory
- http://www.debian.org/security/2016/dsa-3650Third Party Advisory
- http://www.securityfocus.com/bid/92527Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036635
- http://www.ubuntu.com/usn/USN-3064-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-3065-1Third Party Advisory
- https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
- https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.htmlMailing List, Vendor Advisory
- https://security.gentoo.org/glsa/201610-04
- https://security.gentoo.org/glsa/201612-01
- http://rhn.redhat.com/errata/RHSA-2016-2674.html
- http://www.debian.org/security/2016/dsa-3649Third Party Advisory
- http://www.debian.org/security/2016/dsa-3650Third Party Advisory
- http://www.securityfocus.com/bid/92527Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036635
- http://www.ubuntu.com/usn/USN-3064-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-3065-1Third Party Advisory
- https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
- https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.htmlMailing List, Vendor Advisory
- https://security.gentoo.org/glsa/201610-04
- https://security.gentoo.org/glsa/201612-01
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.