CVE-2021-40530: Medium severity Cryptopp Crypto\+\+ vulnerability
The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-40530?
CVE-2021-40530 is a vulnerability in the ElGamal implementation in Crypto++ through version 8.5.
How does CVE-2021-40530 allow plaintext recovery?
CVE-2021-40530 allows plaintext recovery due to a certain dangerous combination of parameters during interaction between cryptographic libraries.
Which software is affected by CVE-2021-40530?
The affected software includes Crypto++ versions up to and including 8.5, as well as Fedora versions 33, 34, and 35.
What is the severity of CVE-2021-40530?
CVE-2021-40530 has a severity rating of 5.9, which is considered medium.
How can I find more information about CVE-2021-40530?
You can find more information about CVE-2021-40530 on the following references: [Reference 1](https://eprint.iacr.org/2021/923), [Reference 2](https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1), [Reference 3](https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2).