CVE-2021-33560

 

Published at: - 08-06-2021 01:15

Last modified: - 25-07-2022 08:15

Total changes: - 16

Description

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://dev.gnupg.org/T5466
• https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61
• https://dev.gnupg.org/T5305
• https://dev.gnupg.org/T5328
• [debian-lts-announce] 20210624 [SECURITY] [DLA 2691-1] libgcrypt20 security update-Mailing List, Third Party Advisory
• FEDORA-2021-24d4e06195-Mailing List, Third Party Advisory
• FEDORA-2021-31fdc84207-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• N/A-

 

Keywords

NVD

 

CVE-2021-33560

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures