USN-3347-1: Libgcrypt vulnerabilities
Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this attack to recover RSA private keys. (CVE-2017-7526) It was discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this attack to possibly recover EdDSA private keys. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-9526)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-3347-1?
The severity of USN-3347-1 is considered high due to its potential for local attackers to exploit side channel vulnerabilities in Libgcrypt.
How do I fix USN-3347-1?
To fix USN-3347-1, upgrade Libgcrypt to the recommended versions: 1.7.6-1ubuntu0.1 for Ubuntu 17.04, 1.7.2-2ubuntu1.1 for Ubuntu 16.10, 1.6.5-2ubuntu0.3 for Ubuntu 16.04, or 1.5.3-2ubuntu4.5 for Ubuntu 14.04.
Who discovered the vulnerability USN-3347-1?
The vulnerability USN-3347-1 was discovered by researchers including Daniel J. Bernstein, Joachim Breitner, and several others.
What package is affected by USN-3347-1?
The package affected by USN-3347-1 is Libgcrypt, specifically versions prior to the patched releases mentioned in the advisory.
Is USN-3347-1 related to side channel attacks?
Yes, USN-3347-1 specifically addresses vulnerabilities in Libgcrypt that can be exploited via side channel attacks.