libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1 | Jul 26, 2018 | Jul 26, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 26, 2018 |
| Debian | — | Upgrade gnupg1Upgrade libgcrypt20Upgrade libgcrypt11Upgrade gnupg | Jul 3, 2017 | Jun 29, 2017 |
| Freebsd | — | Upgrade libgcryptUpgrade gnupg1Upgrade gnupg | Jul 1, 2017 | Jun 30, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Jul 23, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Sep 25, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Nov 19, 2019 | Jul 26, 2018 |
| Oracle Solaris | — | Upgrade system/library/security/libgcrypt to version 1.7.8-0.175.3.25.0.3.0 on Solaris 11.3 | Nov 30, 2017 | Nov 30, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2018 |
| Suse | — | Upgrade libgcrypt11-32bitUpgrade libgcrypt-devel-32bitUpgrade libgcrypt20-32bitUpgrade sles12sp2-docker-imageUpgrade sles12-docker-imageUpgrade sles12sp1-docker-imageUpgrade libgcrypt20-hmacUpgrade libgcrypt11Upgrade libgcrypt-develUpgrade libgcrypt11-x86Upgrade libgcrypt20-hmac-32bitUpgrade libgcrypt20Upgrade compat-libgcrypt11 | Jul 6, 2017 | Jun 29, 2017 |
| Ubuntu | — | Upgrade gpgvUpgrade libgcrypt20Upgrade gnupg-curlUpgrade gnupgUpgrade libgcrypt11 | Jul 4, 2017 | Jun 29, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub