New upstream release fixing CVE-2015-7511 low impact security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libgcrypt packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

GnuPG reports :

Mitigate side-channel attack on ECDH with Weierstrass curves.

This update for libgcrypt fixes the following issues :

  - CVE-2015-7511: side-channel attack on ECDH with     Weierstrass curves (boo#965902)

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

    This update was imported from the SUSE:SLE-12:Update     update project.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

The remote host is affected by the vulnerability described in GLSA-201610-04 (libgcrypt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libgcrypt. Please       review the CVE identifiers referenced below for details.
  Impact :

    Side-channel attacks can leak private key information. A separate       critical bug allows an attacker who obtains 4640 bits from the RNG to       trivially predict the next 160 bits of output.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2896-1 advisory.

    Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to     an attack via physical side channels. A local attacker could use this attack to possibly recover private     keys.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

ID	Name	Product	Family	Published	Updated	Severity
92535	Fedora 24 : libgcrypt (2016-83cd045bcc)	Nessus	Fedora Local Security Checks	7/25/2016	1/11/2021	low
88911	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : libgcrypt (SSA:2016-054-03)	Nessus	Slackware Local Security Checks	2/24/2016	1/14/2021	low
88744	FreeBSD : libgcrypt -- side-channel attack on ECDH (95b92e3b-d451-11e5-9794-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	2/16/2016	1/4/2021	low
88979	openSUSE Security Update : libgcrypt (openSUSE-2016-267)	Nessus	SuSE Local Security Checks	2/26/2016	1/19/2021	low
90911	openSUSE Security Update : libgcrypt (openSUSE-2016-559)	Nessus	SuSE Local Security Checks	5/5/2016	1/19/2021	low
88725	Debian DSA-3474-1 : libgcrypt20 - security update	Nessus	Debian Local Security Checks	2/15/2016	1/11/2021	low
93946	GLSA-201610-04 : libgcrypt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/11/2016	1/11/2021	medium
88747	Ubuntu 14.04 LTS : Libgcrypt vulnerability (USN-2896-1)	Nessus	Ubuntu Local Security Checks	2/16/2016	8/27/2024	low
92769	Fedora 23 : libgcrypt (2016-ec4c27d766)	Nessus	Fedora Local Security Checks	8/8/2016	1/11/2021	low
90587	SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2016:1089-1)	Nessus	SuSE Local Security Checks	4/19/2016	1/6/2021	low
88741	Debian DSA-3478-1 : libgcrypt11 - security update	Nessus	Debian Local Security Checks	2/16/2016	1/11/2021	low

Detections

Analytics

Plugins Search

low

low

low

low

low

low

medium

low

low

low

low