CVE-2014-5270: Infoleak
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5270?
CVE-2014-5270 is considered a high severity vulnerability due to potential key-extraction attacks.
How do I fix CVE-2014-5270?
To fix CVE-2014-5270, upgrade Libgcrypt to version 1.5.4 or later.
What products are affected by CVE-2014-5270?
CVE-2014-5270 affects Libgcrypt versions prior to 1.5.4, which is used in GnuPG and other software.
What kind of attacks can CVE-2014-5270 enable?
CVE-2014-5270 can enable physically proximate attackers to conduct key-extraction attacks.
Is there a known workaround for CVE-2014-5270?
There are no known workarounds for CVE-2014-5270; upgrading to a patched version is the recommended action.