DSA-4231: -1 libgcrypt20 -- security update
Published Jun 17, 2018
·Updated
It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.
Affected Software
2 affected components
debian/libgcrypt20
debian/libgcrypt20
Event History
Jun 17, 2018
Advisory Published
12:00 AM
Frequently Asked Questions
1
Who is exposed to this issue?
Systems using the Debian libgcrypt20 package are exposed if they perform ECDSA operations with private keys that could be observed by a local attacker.
2
What access does an attacker need?
The issue is described as a local side-channel attack, so the attacker needs local access or a local execution position from which to observe cryptographic operations.
3
What could an attacker obtain through exploitation?
Successful exploitation may allow recovery of ECDSA private keys.