Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgcrypt | Nov 8, 2019 | Oct 10, 2014 |
| Debian | — | Upgrade libgcrypt11Upgrade gnupgUpgrade libgcrypt20 | Jul 30, 2024 | Oct 10, 2014 |
| Gentoo Linux | — | Upgrade dev-libs/libgcrypt. | Oct 30, 2017 | Oct 9, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Jul 23, 2019 | Oct 10, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Sep 25, 2019 | Oct 10, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Nov 19, 2019 | Oct 10, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 8, 2014 |
| Suse | — | Upgrade libgcrypt11Upgrade libgcrypt11-x86Upgrade libgcrypt-devel-32bitUpgrade libgcrypt-develUpgrade libgcrypt11-32bit | Dec 18, 2015 | Sep 1, 2014 |
| Ubuntu | — | Upgrade gnupgUpgrade libgcrypt11Upgrade gnupg2 | Nov 8, 2024 | Oct 10, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub