DSA-3901: -1 libgcrypt20 -- security update

Published Jul 2, 2017

Updated

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack allowing full key recovery for RSA-1024.

Affected Software

2 affected components

debian/libgcrypt20

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libgcrypt20 to a version that resolves this vulnerability.
Patch DSA-3901-1

Event History

Jul 2, 2017

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-7526

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as a local side-channel attack, so the attacker needs the ability to run or otherwise observe activity locally on the affected system.

What cryptographic material is at risk?

The reported impact is full recovery of RSA-1024 keys.

DSA-3901: -1 libgcrypt20 -- security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What cryptographic material is at risk?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What cryptographic material is at risk?