Description
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Exploits (1)
References (12)
Core 12
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202210-13
Release Notes, Vendor Advisory
https://dev.gnupg.org/T5305
Vendor Advisory
https://dev.gnupg.org/T5328
Release Notes, Vendor Advisory
https://dev.gnupg.org/T5466
Patch, Vendor Advisory
https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61
Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Scores
CVSS v3
7.5
EPSS
0.0043
EPSS Percentile
62.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-325
CWE-203
Status
published
Products (12)
debian/debian_linux
9.0
fedoraproject/fedora
33
fedoraproject/fedora
34
gnupg/libgcrypt
< 1.8.8
oracle/communications_cloud_native_core_binding_support_function
1.11.0
oracle/communications_cloud_native_core_network_function_cloud_native_environment
1.9.0
oracle/communications_cloud_native_core_network_function_cloud_native_environment
1.10.0
oracle/communications_cloud_native_core_network_repository_function
1.14.0
oracle/communications_cloud_native_core_network_repository_function
1.15.0
oracle/communications_cloud_native_core_network_repository_function
1.15.1
... and 2 more
Published
Jun 08, 2021
Tracked Since
Feb 18, 2026