GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgcrypt | Aug 30, 2017 | Aug 19, 2013 |
| Centos_linux | — | Upgrade libgcryptUpgrade gnupgUpgrade libgcrypt-devel | Dec 1, 2016 | Aug 19, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 19, 2016 |
| Freebsd | — | Upgrade linux-f10-libgcryptUpgrade libgcrypt | Dec 10, 2025 | Aug 17, 2013 |
| Gentoo Linux | — | Upgrade dev-libs/libgcrypt.Upgrade app-crypt/gnupg. | Oct 30, 2017 | Aug 19, 2013 |
| Oracle Solaris | — | Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade library/security/libgpg-error to version 1.12-0.175.1.18.0.2.0 on Solaris 11.1Upgrade system/library/security/libgcrypt to version 1.5.3-0.175.1.18.0.2.0 on Solaris 11.1Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | May 29, 2017 | Aug 19, 2013 |
| Oracle_linux | — | Upgrade libgcrypt-develUpgrade libgcrypt | Oct 16, 2024 | Aug 19, 2013 |
| Suse | — | Upgrade gpgUpgrade sle-sdk-releaseUpgrade libgcrypt-devel-32bitUpgrade libgcrypt-develUpgrade libgcrypt11Upgrade libgcrypt11-x86Upgrade libgcrypt11-32bit | Dec 12, 2013 | Aug 19, 2013 |
| Ubuntu | — | Upgrade gnupgUpgrade libgcrypt11 | Nov 8, 2024 | Aug 19, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub