It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4482 advisory.

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libgcrypt packages installed that are affected by a vulnerability:

  - It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
    (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4482 advisory.

  - libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4482 advisory.

    [1.8.5-4]
    - add PBKDF2 selftest for FIPS POST

    [1.8.5-3]
    - new upstream version 1.8.5
    - AES performance improvements backported from master branch
    - FIPS module is implicit with kernel FIPS flag
    - always run the FIPS selftests if FIPS module is installed

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4482 advisory.

    The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.

    The following packages have been upgraded to a later upstream version: libgcrypt (1.8.5). (BZ#1764918)

    Security Fix(es):

    * libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-32 (Libgcrypt: Side-channel attack)

    A timing attack was found in the way ECCDSA was implemented in       Libgcrypt.
  Impact :

    A local man-in-the-middle attacker, during signature generation, could       possibly recover the private key.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4236-2 advisory.

    USN-4236-1 fixed a vulnerability in Libgcrypt. This update provides the corresponding fix for Ubuntu 16.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4236-1 advisory.

    It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use     this attack to recover sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libgcrypt fixes the following issues :

Security issues fixed :

  - CVE-2019-13627: Mitigation against an ECDSA timing     attack (bsc#1148987).

Bug fixes :

  - Added CMAC AES self test (bsc#1155339).

  - Added CMAC TDES self test missing (bsc#1155338).

  - Fix test dsa-rfc6979 in FIPS mode.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987).

Bug fixes: Added CMAC AES self test (bsc#1155339).

Added CMAC TDES self test missing (bsc#1155338).

Fix test dsa-rfc6979 in FIPS mode.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and     1.6.3-2+deb8u4.(CVE-2019-13627)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete.

For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young <china@thewrittenword.com> for the report.

We recommend that you upgrade your libgcrypt20 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GnuPG reports :

Mitigate an ECDSA timing attack.

ID	Name	Product	Family	Severity
184499	Rocky Linux 8 : libgcrypt (RLSA-2020:4482)	Nessus	Rocky Linux Local Security Checks	medium
157566	AlmaLinux 8 : libgcrypt (ALSA-2020:4482)	Nessus	Alma Linux Local Security Checks	medium
147304	NewStart CGSL MAIN 6.02 : libgcrypt Vulnerability (NS-SA-2021-0071)	Nessus	NewStart CGSL Local Security Checks	medium
145939	CentOS 8 : libgcrypt (CESA-2020:4482)	Nessus	CentOS Local Security Checks	medium
142776	Oracle Linux 8 : libgcrypt (ELSA-2020-4482)	Nessus	Oracle Linux Local Security Checks	medium
142393	RHEL 8 : libgcrypt (RHSA-2020:4482)	Nessus	Red Hat Local Security Checks	medium
134609	GLSA-202003-32 : Libgcrypt: Side-channel attack	Nessus	Gentoo Local Security Checks	medium
132931	Ubuntu 16.04 LTS : Libgcrypt vulnerability (USN-4236-2)	Nessus	Ubuntu Local Security Checks	medium
132930	Ubuntu 18.04 LTS : Libgcrypt vulnerability (USN-4236-1)	Nessus	Ubuntu Local Security Checks	medium
132909	openSUSE Security Update : libgcrypt (openSUSE-2020-22)	Nessus	SuSE Local Security Checks	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	medium
132432	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:3392-1)	Nessus	SuSE Local Security Checks	medium
130816	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	Nessus	Huawei Local Security Checks	medium
129529	SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2019:2510-1)	Nessus	SuSE Local Security Checks	medium
129337	openSUSE Security Update : libgcrypt (openSUSE-2019-2161)	Nessus	SuSE Local Security Checks	medium
129305	Debian DLA-1931-2 : libgcrypt20 regression update	Nessus	Debian Local Security Checks	medium
128679	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:2349-1)	Nessus	SuSE Local Security Checks	medium
128439	FreeBSD : libgcrypt -- ECDSA timing attack (c9c6c2f8-cd54-11e9-af89-080027ef1a23)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-13627

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium