USN-3689-2: Libgcrypt vulnerability
USN-3689-1 fixed a vulnerability in Libgcrypt. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could possibly use this attack to recover ECDSA private keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libgcrypt11to a version that resolves this vulnerability.Fixed in 1.5.0-3ubuntu0.8 - Upgrade
Upgrade
Libgcryptto a version that resolves this vulnerability.Patch USN-3689-1 - Upgrade
Upgrade
Libgcryptto a version that resolves this vulnerability.Patch USN-3689-2
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is USN-3689-2.
What is the title of the vulnerability?
The title of the vulnerability is 'USN-3689-2: Libgcrypt vulnerability'.
What software is affected by this vulnerability?
The affected software is libgcrypt11 version 1.5.0-3ubuntu0.8 running on Ubuntu 12.04.
How can I fix this vulnerability?
To fix this vulnerability, you should update the libgcrypt11 package to version 1.5.0-3ubuntu0.8 or later.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [CVE-2018-0495](https://ubuntu.com/security/CVE-2018-0495), [USN-3692-1](https://ubuntu.com/security/notices/USN-3692-1), [USN-3692-2](https://ubuntu.com/security/notices/USN-3692-2).