The vulnerability of the Python ECDSA cryptographic library, related to insufficient processing of exceptional states, allows a perpetrator to trigger a service failure.

🗓️ 23 Apr 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Python ECDSA library flaw: improper exceptional state handling and unsynchronized shared resources enable remote service failures.

Reporter	Title	Published	Views	Family All 89
Tenable Nessus	AlmaLinux 8 : libgcrypt (ALSA-2020:4482)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : libgcrypt (CESA-2020:4482)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DLA-1931-2 : libgcrypt20 regression update	25 Sep 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	12 Nov 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	13 Jan 202000:00	–	nessus
Tenable Nessus	FreeBSD : libgcrypt -- ECDSA timing attack (c9c6c2f8-cd54-11e9-af89-080027ef1a23)	3 Sep 201900:00	–	nessus
Tenable Nessus	GLSA-202003-32 : Libgcrypt: Side-channel attack	16 Mar 202000:00	–	nessus
Tenable Nessus	MiracleLinux 8 : libgcrypt-1.8.5-4.el8 (AXSA:2020-1018:01)	20 Jan 202600:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.02 : libgcrypt Vulnerability (NS-SA-2021-0071)	10 Mar 202100:00	–	nessus
Tenable Nessus	openSUSE Security Update : libgcrypt (openSUSE-2019-2161)	25 Sep 201900:00	–	nessus

Vulners

Node

novell suse_enterprise_storageMatch4

OR

novell suse_openstack_cloudMatch7

OR

novell suse_caas_platformMatch3.0

OR

novell suse_enterprise_storageMatch5

OR

novell suse_openstack_cloudMatch8

OR

novell hpe_helion_openstackMatch8

OR

werner_koch libgcryptRange<1.8.4

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.0

OR

novell opensuse_leapMatch15.1

OR

canonical ubuntuMatch19.10

OR

canonical ubuntuMatch20.04

Source	Link
suse	www.suse.com/security/cve/CVE-2019-13627/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-13627
people	www.people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13627.html
usn	www.usn.ubuntu.com/4236-1/
usn	www.usn.ubuntu.com/4236-2/
bugs	www.bugs.debian.org/cgi-bin/bugreport.cgi
access	www.access.redhat.com/security/cve/cve-2019-13627
lists	www.lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html
openwall	www.openwall.com/lists/oss-security/2019/10/02/2

27 Apr 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 22.6

CVSS 33.6

EPSS0.0051

Python ECDSA library exceptional state handling unsynchronized shared resources remote service failures concurrency issue