Medium: libgcrypt, gnupg

2016-09-15T19:00:00
ID ALAS-2016-744
Type amazon
Reporter Amazon
Modified 2016-09-15T19:00:00

Description

Issue Overview:

A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker who can obtain the first 580 bytes of the PRNG output can trivially predict the following 20 bytes.

Affected Packages:

libgcrypt, gnupg

Issue Correction:
Run yum update libgcrypt to update your system.
Run yum update gnupg to update your system.

New Packages:

i686:  
    libgcrypt-devel-1.5.3-12.19.amzn1.i686  
    libgcrypt-1.5.3-12.19.amzn1.i686  
    libgcrypt-debuginfo-1.5.3-12.19.amzn1.i686  
    gnupg-debuginfo-1.4.19-1.28.amzn1.i686  
    gnupg-1.4.19-1.28.amzn1.i686

src:  
    libgcrypt-1.5.3-12.19.amzn1.src  
    gnupg-1.4.19-1.28.amzn1.src

x86_64:  
    libgcrypt-devel-1.5.3-12.19.amzn1.x86_64  
    libgcrypt-1.5.3-12.19.amzn1.x86_64  
    libgcrypt-debuginfo-1.5.3-12.19.amzn1.x86_64  
    gnupg-debuginfo-1.4.19-1.28.amzn1.x86_64  
    gnupg-1.4.19-1.28.amzn1.x86_64