CVE-2017-0379: Infoleak
Published Aug 27, 2017
·Updated
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
Affected Software
4 affected componentsFixes available
debian/libgcrypt20<=1.8.0-1, <=1.7.1-1
1.8.1-11.7.9-11.7.6-2+deb9u2
gnupg Libgcrypt<=1.8.0
Debian Debian Linux=9.0
debian/libgcrypt20
1.8.7-61.10.1-31.11.0-71.11.2-3
Remediation
Patch Available
Patch Available
Event History
Aug 29, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Feb 19, 2026
Data Sourced
via Debian·07:27 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-0379?
CVE-2017-0379 is considered to have a medium severity level due to its potential impact on the confidentiality of secret keys.
2
How do I fix CVE-2017-0379?
To fix CVE-2017-0379, upgrade Libgcrypt to version 1.8.1 or later.
3
What software is affected by CVE-2017-0379?
CVE-2017-0379 affects versions of Libgcrypt prior to 1.8.1 and Debian Linux 9.0 installations.
4
What types of attacks does CVE-2017-0379 relate to?
CVE-2017-0379 relates to side-channel attacks on Curve25519 implementations.
5
How can CVE-2017-0379 impact security?
CVE-2017-0379 can potentially allow attackers to more easily discover secret keys used in cryptographic operations.