libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1 | Jul 26, 2018 | Jul 26, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 26, 2018 |
| Debian | — | Upgrade gnupg1Upgrade gnupgUpgrade libgcrypt20Upgrade libgcrypt11 | Jul 3, 2017 | Jun 29, 2017 |
| Freebsd | — | Upgrade gnupg1Upgrade libgcryptUpgrade gnupg | Jul 1, 2017 | Jun 30, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Jul 23, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Sep 25, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Nov 19, 2019 | Jul 26, 2018 |
| Oracle Solaris | — | Upgrade system/library/security/libgcrypt to version 1.7.8-0.175.3.25.0.3.0 on Solaris 11.3 | Nov 30, 2017 | Nov 30, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2018 |
| Suse | — | Upgrade sles12sp2-docker-imageUpgrade libgcrypt-devel-32bitUpgrade libgcrypt20-32bitUpgrade libgcrypt11-32bitUpgrade sles12-docker-imageUpgrade compat-libgcrypt11Upgrade libgcrypt11-x86Upgrade libgcrypt20-hmac-32bitUpgrade sles12sp1-docker-imageUpgrade libgcrypt20Upgrade libgcrypt20-hmacUpgrade libgcrypt-develUpgrade libgcrypt11 | Jul 6, 2017 | Jun 29, 2017 |
| Ubuntu | — | Upgrade gnupgUpgrade libgcrypt20Upgrade gpgvUpgrade gnupg-curlUpgrade libgcrypt11 | Jul 4, 2017 | Jun 29, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub