[SECURITY] [DLA 2691-1] libgcrypt20 security update

2021-06-2422:55:50

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

61.6%

JSON

Debian LTS Advisory DLA-2691-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
June 25, 2021 https://wiki.debian.org/LTS

Package : libgcrypt20
Version : 1.7.6-2+deb9u4
CVE ID : CVE-2021-33560

An issue has been found in libgcrypt20, a crypto library.
Mishandling of ElGamal encryption results in a possible side-channel
attack and an interoperability problem with keys not generated by
GnuPG/libgcrypt.

For Debian 9 stretch, this problem has been fixed in version
1.7.6-2+deb9u4.

We recommend that you upgrade your libgcrypt20 packages.

For the detailed security status of libgcrypt20 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libgcrypt20

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9armellibgcrypt11-dev< 1.5.4-3+really1.7.6-2+deb9u4libgcrypt11-dev_1.5.4-3+really1.7.6-2+deb9u4_armel.deb
Debian9armhflibgcrypt11-dev< 1.5.4-3+really1.7.6-2+deb9u4libgcrypt11-dev_1.5.4-3+really1.7.6-2+deb9u4_armhf.deb
Debian9arm64libgcrypt20-udeb< 1.7.6-2+deb9u4libgcrypt20-udeb_1.7.6-2+deb9u4_arm64.deb
Debian9armhflibgcrypt20< 1.7.6-2+deb9u4libgcrypt20_1.7.6-2+deb9u4_armhf.deb
Debian9i386libgcrypt20< 1.7.6-2+deb9u4libgcrypt20_1.7.6-2+deb9u4_i386.deb
Debian9i386libgcrypt20-dev< 1.7.6-2+deb9u4libgcrypt20-dev_1.7.6-2+deb9u4_i386.deb
Debian9armellibgcrypt20-udeb< 1.7.6-2+deb9u4libgcrypt20-udeb_1.7.6-2+deb9u4_armel.deb
Debian9arm64libgcrypt20< 1.7.6-2+deb9u4libgcrypt20_1.7.6-2+deb9u4_arm64.deb
Debian9armhflibgcrypt20-udeb< 1.7.6-2+deb9u4libgcrypt20-udeb_1.7.6-2+deb9u4_armhf.deb
Debian9amd64libgcrypt20-udeb< 1.7.6-2+deb9u4libgcrypt20-udeb_1.7.6-2+deb9u4_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	armel	libgcrypt11-dev	< 1.5.4-3+really1.7.6-2+deb9u4	libgcrypt11-dev_1.5.4-3+really1.7.6-2+deb9u4_armel.deb
Debian	9	armhf	libgcrypt11-dev	< 1.5.4-3+really1.7.6-2+deb9u4	libgcrypt11-dev_1.5.4-3+really1.7.6-2+deb9u4_armhf.deb
Debian	9	arm64	libgcrypt20-udeb	< 1.7.6-2+deb9u4	libgcrypt20-udeb_1.7.6-2+deb9u4_arm64.deb
Debian	9	armhf	libgcrypt20	< 1.7.6-2+deb9u4	libgcrypt20_1.7.6-2+deb9u4_armhf.deb
Debian	9	i386	libgcrypt20	< 1.7.6-2+deb9u4	libgcrypt20_1.7.6-2+deb9u4_i386.deb
Debian	9	i386	libgcrypt20-dev	< 1.7.6-2+deb9u4	libgcrypt20-dev_1.7.6-2+deb9u4_i386.deb
Debian	9	armel	libgcrypt20-udeb	< 1.7.6-2+deb9u4	libgcrypt20-udeb_1.7.6-2+deb9u4_armel.deb
Debian	9	arm64	libgcrypt20	< 1.7.6-2+deb9u4	libgcrypt20_1.7.6-2+deb9u4_arm64.deb
Debian	9	armhf	libgcrypt20-udeb	< 1.7.6-2+deb9u4	libgcrypt20-udeb_1.7.6-2+deb9u4_armhf.deb
Debian	9	amd64	libgcrypt20-udeb	< 1.7.6-2+deb9u4	libgcrypt20-udeb_1.7.6-2+deb9u4_amd64.deb