An update of the libgcrypt package has been released.

This update for libgcrypt fixes the following issues :

Security issue fixed :

CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation (bsc#1138939).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other processes. (The C implementation is used on platforms     where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue     report cannot be validated because there is no description of an attack (CVE-2019-12904)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

  - CVE-2019-12904: The C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.) (bsc#1138939)

Other bugfixes :

  - Don't run full FIPS self-tests from constructor     (bsc#1097073)

  - Skip all the self-tests except for binary integrity when     called from the constructor (bsc#1097073)

  - Enforce the minimal RSA keygen size in fips mode     (bsc#1125740)

  - avoid executing some tests twice.

  - Fixed a race condition in initialization.

  - Fixed env-script-interpreter in cavs_driver.pl

  - Fixed redundant fips tests in some situations causing     failure to boot in fips mode. (bsc#1097073)

This helps during booting of the system in FIPS mode with insufficient entropy.

This update was imported from the SUSE:SLE-15:Update update project.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939)

Other bugfixes: Don't run full FIPS self-tests from constructor (bsc#1097073)

Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073)

Enforce the minimal RSA keygen size in fips mode (bsc#1125740)

avoid executing some tests twice.

Fixed a race condition in initialization.

Fixed env-script-interpreter in cavs_driver.pl

Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073)

This helps during booting of the system in FIPS mode with insufficient entropy.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and     1.6.3-2+deb8u4.(CVE-2019-13627)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
203084	Photon OS 3.0: Libgcrypt PHSA-2019-3.0-0036	Nessus	PhotonOS Local Security Checks	7/23/2024	7/24/2024	medium
127089	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:1971-1)	Nessus	SuSE Local Security Checks	7/26/2019	5/8/2024	medium
203109	Photon OS 2.0: Libgcrypt PHSA-2020-2.0-0227	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	medium
222563	Linux Distros Unpatched Vulnerability : CVE-2019-12904	Nessus	Misc.	3/4/2025	3/4/2025	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	1/13/2020	5/18/2022	medium
135490	Photon OS 1.0: Libgcrypt PHSA-2020-1.0-0288	Nessus	PhotonOS Local Security Checks	4/15/2020	4/21/2020	medium
126976	openSUSE Security Update : libgcrypt (openSUSE-2019-1792)	Nessus	SuSE Local Security Checks	7/24/2019	5/8/2024	medium
126770	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:1859-1)	Nessus	SuSE Local Security Checks	7/17/2019	5/9/2024	medium
130816	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	Nessus	Huawei Local Security Checks	11/12/2019	5/18/2022	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium