Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Minor security update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Minor security update release 1.7.9.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libgcrypt packages are available for Slackware 14.2 and -current to fix a security issue.

Daniel Genkin, Luke Valenta, and Yuval Yarom discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this attack to recover Curve25519 private keys.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GnuPG reports :

Mitigate a local side-channel attack on Curve25519 dubbed 'May the Fourth Be With You'.

Daniel Genkin, Luke Valenta and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack against the ECDH encryption with Curve25519, allowing recovery of the private key.

See https://eprint.iacr.org/2017/806 for details.

ID	Name	Product	Family	Severity
105947	Fedora 27 : libgcrypt (2017-a9c79eed83)	Nessus	Fedora Local Security Checks	high
104602	Fedora 25 : libgcrypt (2017-8cd171f540)	Nessus	Fedora Local Security Checks	high
104449	Fedora 26 : libgcrypt (2017-bcdeca9d41)	Nessus	Fedora Local Security Checks	high
103307	Slackware 14.2 / current : libgcrypt (SSA:2017-261-02)	Nessus	Slackware Local Security Checks	high
103250	Ubuntu 17.04 : libgcrypt20 vulnerability (USN-3417-1)	Nessus	Ubuntu Local Security Checks	high
102846	FreeBSD : libgcrypt -- side-channel attack vulnerability (22f28bb3-8d98-11e7-8c37-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
102826	Debian DSA-3959-1 : libgcrypt20 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-0379

high

Tenable Plugins

high

high

high

high

high

high

high