libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1 | Jul 26, 2018 | Jul 26, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 26, 2018 |
| Debian | — | Upgrade libgcrypt11Upgrade gnupgUpgrade libgcrypt20Upgrade gnupg1 | Jul 3, 2017 | Jun 29, 2017 |
| Freebsd | — | Upgrade gnupg1Upgrade libgcryptUpgrade gnupg | Jul 1, 2017 | Jun 30, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Jul 23, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Sep 25, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Nov 19, 2019 | Jul 26, 2018 |
| Oracle Solaris | — | Upgrade system/library/security/libgcrypt to version 1.7.8-0.175.3.25.0.3.0 on Solaris 11.3 | Nov 30, 2017 | Nov 30, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2018 |
| Suse | — | Upgrade libgcrypt11-32bitUpgrade libgcrypt20-32bitUpgrade libgcrypt-devel-32bitUpgrade sles12-docker-imageUpgrade sles12sp2-docker-imageUpgrade libgcrypt20-hmacUpgrade libgcrypt20-hmac-32bitUpgrade libgcrypt11Upgrade libgcrypt20Upgrade sles12sp1-docker-imageUpgrade libgcrypt-develUpgrade compat-libgcrypt11Upgrade libgcrypt11-x86 | Jul 6, 2017 | Jun 29, 2017 |
| Ubuntu | — | Upgrade libgcrypt11Upgrade gnupg-curlUpgrade gnupgUpgrade libgcrypt20Upgrade gpgv | Jul 4, 2017 | Jun 29, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub