The vulnerability of the _gcry_ecc_ecdsa_sign function in the Libgcrypt cryptographic library allows a perpetrator to gain unauthorized access to protected information.

🗓️ 07 Feb 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Libgcrypt gcry_ecc_ecdsa_sign allows a local attacker on the same node to deduce signature parameters.

Reporter	Title	Published	Views	Family All 214
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance affected by NSS and libgcrypt vulnerabilities (CVE-2018-12404 and CVE-2018-0495)	23 Jan 202015:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM	17 Dec 201815:00	–	ibm
IBM Security Bulletins	Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway	8 Jun 202121:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple openssl vulnerabilities.	7 Dec 201802:45	–	ibm
FreeBSD	libgcrypt -- side-channel attack vulnerability	13 Jun 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : openssl (ALAS-2018-1102)	9 Nov 201800:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nss (ALAS-2019-1305)	4 Oct 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : openssl (ALAS-2018-1102)	7 Dec 201800:00	–	nessus

Vulners

Node

werner_koch libgcryptRange<1.7.10

OR

werner_koch libgcryptRange1.8.0–1.8.3

OR

oracle oracle_traffic_directorMatch11.1.1.9.0

OR

canonical ubuntuMatch17.10

Source	Link
securitytracker	www.securitytracker.com/id/1041144
securitytracker	www.securitytracker.com/id/1041147
access	www.access.redhat.com/errata/RHSA-2018:3221
access	www.access.redhat.com/errata/RHSA-2018:3505
dev	www.dev.gnupg.org/T4011
git	www.git.gnupg.org/cgi-bin/gitweb.cgi
lists	www.lists.debian.org/debian-lts-announce/2018/06/msg00013.html
lists	www.lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html
usn	www.usn.ubuntu.com/3689-1/
usn	www.usn.ubuntu.com/3689-2/

23 Mar 2021 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.7

CVSS 34.7

EPSS0.00887

libgcrypt ecdsa signature local attacker same node signature parameters