USN-3689-1: Libgcrypt vulnerability
Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could possibly use this attack to recover ECDSA private keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.8.1-4ubuntu1.1 - Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.7.8-2ubuntu1.1 - Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.6.5-2ubuntu0.5 - Upgrade
Upgrade
ubuntu/libgcrypt11to a version that resolves this vulnerability.Fixed in 1.5.3-2ubuntu4.6
Event History
Frequently Asked Questions
What is the vulnerability ID for this Libgcrypt vulnerability?
The vulnerability ID for this Libgcrypt vulnerability is USN-3689-1.
What is the description of the Libgcrypt vulnerability?
The Libgcrypt vulnerability discovered by Keegan Ryan is susceptible to a side-channel attack that could allow a local attacker to recover ECDSA private keys.
Which versions of Ubuntu are affected by the Libgcrypt vulnerability?
The Libgcrypt vulnerability affects Ubuntu versions 18.04, 17.10, 16.04, and 14.04.
How can I fix the Libgcrypt vulnerability on Ubuntu 18.04?
To fix the Libgcrypt vulnerability on Ubuntu 18.04, update the libgcrypt20 package to version 1.8.1-4ubuntu1.1.
Where can I find more information about the Libgcrypt vulnerability?
More information about the Libgcrypt vulnerability can be found on the Ubuntu security page: [link](https://ubuntu.com/security/CVE-2018-0495).