USN-4236-1: Libgcrypt vulnerability
It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use this attack to recover sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.8.4-5ubuntu2.1 - Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.8.4-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.8.1-4ubuntu1.2
Event History
Frequently Asked Questions
What is the vulnerability ID for the Libgcrypt vulnerability?
The vulnerability ID for the Libgcrypt vulnerability is CVE-2019-13627.
What is the description of the Libgcrypt vulnerability?
The Libgcrypt vulnerability is susceptible to an ECDSA timing attack which could allow an attacker to recover sensitive information.
Which software is affected by the Libgcrypt vulnerability?
The Libgcrypt vulnerability affects the libgcrypt20 package.
How can I fix the Libgcrypt vulnerability?
To fix the Libgcrypt vulnerability, you need to update the libgcrypt20 package to version 1.8.4-5ubuntu2.1 (for Ubuntu 19.10), 1.8.4-3ubuntu1.1 (for Ubuntu 19.04), or 1.8.1-4ubuntu1.2 (for Ubuntu 18.04).
Where can I find more information about the Libgcrypt vulnerability?
You can find more information about the Libgcrypt vulnerability in the following references: [USN-4236-2](https://ubuntu.com/security/notices/USN-4236-2) and [USN-4236-3](https://ubuntu.com/security/notices/USN-4236-3).