Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libgcryptUpgrade libressl | Jun 22, 2018 | Jun 13, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nss-debuginfoUpgrade nss-pkcs11-develUpgrade nss-sysinitUpgrade openssl-perlUpgrade openssl-libsUpgrade nss-toolsUpgrade openssl-develUpgrade nssUpgrade opensslUpgrade openssl-debuginfoUpgrade openssl-staticUpgrade nss-devel | Apr 27, 2020 | Jun 13, 2018 |
| Amazon_linux | — | Upgrade nss-softoknUpgrade opensslUpgrade nsprUpgrade nssUpgrade nss-util | Dec 7, 2018 | Jun 13, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 13, 2018 |
| Centos_linux | — | Upgrade nss-toolsUpgrade nss-sysinitUpgrade openssl-libsUpgrade nssUpgrade nss-develUpgrade openssl-staticUpgrade nss-util-develUpgrade nss-debuginfoUpgrade nss-util-debuginfoUpgrade openssl-develUpgrade nsprUpgrade nss-softokn-freebl-develUpgrade opensslUpgrade nss-pkcs11-develUpgrade nss-softokn-freeblUpgrade nss-utilUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade nss-softokn-develUpgrade nss-softokn-debuginfoUpgrade nss-softoknUpgrade nspr-debuginfoUpgrade nspr-devel | Jun 10, 2019 | Jun 13, 2018 |
| Debian | — | Upgrade libgcrypt20 | Jun 19, 2018 | Jun 13, 2018 |
| Freebsd | — | Upgrade libgcrypt | Jun 14, 2018 | Jun 13, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nss-softokn-freebl-develUpgrade nss-softokn-freeblUpgrade nss-softokn-develUpgrade nss-softokn | Dec 31, 2018 | Jun 13, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nss-softokn-develUpgrade nss-softoknUpgrade nss-softokn-freeblUpgrade nss-softokn-freebl-devel | Dec 11, 2018 | Jun 13, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade nss-softokn-freebl-develUpgrade nss-softoknUpgrade nss-softokn-develUpgrade nss-softokn-freebl | Jan 9, 2019 | Jun 13, 2018 |
| Oracle Solaris | — | Upgrade library/java/jss to version 4.3.2-11.4.7.0.1.2.0 on Solaris 11.4Upgrade security/pinentry to version 1.1.0-11.4.9.0.1.1.0 on Solaris 11.4Upgrade security/pinentry-gtk to version 1.1.0-11.4.9.0.1.1.0 on Solaris 11.4Upgrade system/library/mozilla-nss/header-nss to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade SUNWtlsd to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/gmime to version 2.6.23-11.4.9.0.1.1.0 on Solaris 11.4Upgrade SUNWpr to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/security/nss to version 4.38-11.4.7.0.1.2.0 on Solaris 11.4Upgrade system/mozilla-nss to version 4.36.1-11.4.7.0.1.2.0 on Solaris 11.4Upgrade SUNWtls to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/nspr/header-nspr to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade consolidation/sic_team/sic_team-incorporation to version 0.11.5-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/pth to version 2.0.7-11.4.9.0.1.1.0 on Solaris 11.4Upgrade library/java/commons-logging to version 1.0.4-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/npth to version 1.5-11.4.9.0.1.1.0 on Solaris 11.4Upgrade SUNWprd to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/security/libksba to version 1.3.5-11.4.9.0.1.1.0 on Solaris 11.4Upgrade SUNWjss to version 4.3.2-11.4.7.0.1.2.0 on Solaris 11.4Upgrade system/library/mozilla-nss to version 0.5.11-11.4.7.0.1.2.0 on Solaris 11.4Upgrade security/nss-utilities to version 4.36.1-11.4.7.0.1.2.0 on Solaris 11.4Upgrade crypto/gnupg to version 2.2.8-11.4.9.0.1.1.0 on Solaris 11.4Upgrade SUNWaclg to version 1.0.4-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/java/apache-commons-logging to version 1.0.4-11.4.7.0.1.2.0 on Solaris 11.4Upgrade system/library/security/libgcrypt to version 1.7.9-0.175.3.35.0.5.0 on Solaris 11.3Upgrade SUNWtlsu to version 4.36.1-11.4.7.0.1.2.0 on Solaris 11.4Upgrade library/security/libassuan to version 2.5.1-11.4.9.0.1.1.0 on Solaris 11.4Upgrade system/library/security/libgcrypt to version 1.8.3-11.4.9.0.1.1.0 on Solaris 11.4Upgrade library/security/gpgme to version 1.11.1-11.4.9.0.1.1.0 on Solaris 11.4Upgrade library/security/libgpg-error to version 1.31-11.4.9.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | Jun 13, 2018 |
| Oracle_linux | — | Upgrade openssl-develUpgrade nss-softokn-freebl-develUpgrade openssl-perlUpgrade openssl-staticUpgrade nss-softoknUpgrade openssl-libsUpgrade nss-util-develUpgrade nspr-develUpgrade opensslUpgrade nssUpgrade nss-softokn-develUpgrade nss-develUpgrade nss-softokn-freeblUpgrade nss-pkcs11-develUpgrade nss-sysinitUpgrade nss-utilUpgrade nss-toolsUpgrade nspr | Nov 6, 2018 | Jun 13, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Jun 13, 2018 |
| Redhat_linux | — | Upgrade nss-toolsUpgrade openssl-debuginfoUpgrade openssl-develUpgrade nss-debuginfoUpgrade nss-utilNo solution existsUpgrade openssl-staticUpgrade nss-util-debuginfoUpgrade openssl-libsUpgrade nss-develUpgrade nss-util-develUpgrade nss-sysinitUpgrade nss-softokn-freebl-develUpgrade nspr-debuginfoUpgrade nsprUpgrade nss-softokn-develUpgrade nssUpgrade nspr-develUpgrade nss-softokn-debuginfoUpgrade nss-softoknUpgrade nss-softokn-freeblUpgrade openssl-perlUpgrade opensslUpgrade nss-pkcs11-devel | Oct 31, 2018 | Jun 13, 2018 |
| Suse | — | Upgrade mozilla-nssUpgrade libsoftokn3-32bitUpgrade mozilla-nsprUpgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade mozilla-nss-sysinit-32bitUpgrade libgcrypt-cavsUpgrade mozilla-nspr-32bitUpgrade libsoftokn3Upgrade MozillaFirefox-translations-commonUpgrade libfreebl3Upgrade mozilla-nss-sysinitUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade libgcrypt20-hmac-32bitUpgrade MozillaFirefox-develUpgrade libgcrypt-devel-32bitUpgrade libfreebl3-hmacUpgrade libsoftokn3-hmac-32bitUpgrade libgcrypt20-32bitUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-hmacUpgrade mozilla-nss-certs-32bitUpgrade libgcrypt20-hmacUpgrade libfreebl3-32bitUpgrade libgcrypt20Upgrade MozillaFirefoxUpgrade mozilla-nss-32bitUpgrade libgcrypt-develUpgrade mozilla-nss-certs | Jul 28, 2018 | Jun 13, 2018 |
| Ubuntu | — | Upgrade libssl1.1Upgrade libgcrypt20Upgrade libssl1.0.0Upgrade libgcrypt11Upgrade libnss3 | Jun 27, 2018 | Jun 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub