Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libgcryptUpgrade libgcrypt-devel | May 4, 2022 | Jun 8, 2021 |
| Alpine Linux | — | Upgrade libgcrypt | Mar 26, 2024 | Jun 8, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libgcrypt-debuginfoUpgrade libgcryptUpgrade libgcrypt-devel | Jul 4, 2022 | Jun 8, 2021 |
| Amazon_linux | — | Upgrade libgcrypt | Apr 7, 2022 | Jun 8, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2021 |
| Centos_linux | — | Upgrade libgcryptUpgrade libgcrypt-debugsourceUpgrade libgcrypt-devel-debuginfoUpgrade libgcrypt-develUpgrade libgcrypt-debuginfo | Nov 10, 2021 | Jun 8, 2021 |
| Debian | — | Upgrade libgcrypt20 | Jun 28, 2021 | Jun 8, 2021 |
| Gentoo Linux | — | Upgrade dev-libs/libgcrypt. | Oct 31, 2022 | Jun 8, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Sep 16, 2021 | Jun 8, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Oct 26, 2021 | Jun 8, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libgcryptUpgrade libgcrypt-devel | Sep 29, 2021 | Jun 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libgcrypt-develUpgrade libgcrypt | Sep 24, 2021 | Jun 8, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libgcrypt | Sep 29, 2021 | Jun 8, 2021 |
| Oracle Solaris | — | Upgrade system/library/security/libgcrypt to version 1.8.8-11.4.36.0.1.101.0 on Solaris 11.4 | Aug 27, 2021 | Jun 8, 2021 |
| Oracle_linux | — | Upgrade libgcrypt-develUpgrade libgcrypt | Nov 17, 2021 | Jun 2, 2021 |
| Redhat_linux | — | No solution existsUpgrade libgcryptUpgrade libgcrypt-debugsourceUpgrade libgcrypt-debuginfoUpgrade libgcrypt-devel-debuginfoUpgrade libgcrypt-devel | Nov 10, 2021 | Jun 8, 2021 |
| Rocky_linux | — | Upgrade libgcryptUpgrade libgcrypt-debugsourceUpgrade libgcrypt-devel-debuginfoUpgrade libgcrypt-develUpgrade libgcrypt-debuginfo | May 5, 2022 | Jun 8, 2021 |
| Suse | — | Upgrade libgcrypt20-hmacUpgrade libgcrypt20-hmac-32bitUpgrade libgcrypt-cavsUpgrade libgcrypt20Upgrade libgcrypt-devel-32bitUpgrade libgcrypt11-32bitUpgrade libgcrypt11Upgrade libgcrypt-develUpgrade libgcrypt20-32bit | Jun 19, 2021 | Jun 8, 2021 |
| Ubuntu | — | Upgrade libgcrypt20 (Ubuntu Pro)Upgrade libgcrypt20 | Sep 17, 2021 | Jun 8, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub