CVE-2013-4576: Low severity gnupg 2 (gnu privacy guard) vulnerability
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4576?
CVE-2013-4576 has a medium severity rating due to the possibility of RSA key extraction via a chosen-ciphertext attack.
How do I fix CVE-2013-4576?
To fix CVE-2013-4576, update GnuPG to version 1.4.16 or later.
Who is affected by CVE-2013-4576?
CVE-2013-4576 affects all versions of GnuPG 1.x prior to 1.4.16.
What type of attack is associated with CVE-2013-4576?
CVE-2013-4576 is associated with a chosen-ciphertext attack allowing key extraction.
What are the implications of CVE-2013-4576 for users of GnuPG?
Users of GnuPG could have their RSA keys compromised if they are vulnerable to physical attacks in proximity to the device during decryption.