Updated libcryptopp package fixes security vulnerability

2015-08-2121:54:52

Gentoo Foundation

advisories.mageia.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.1%

JSON

Evgeny Sidorov discovered that libcryptopp did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user’s private key (CVE-2015-2141).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchlibcryptopp< 5.6.2-2.1libcryptopp-5.6.2-2.1.mga4
Mageia5noarchlibcryptopp< 5.6.2-4.1libcryptopp-5.6.2-4.1.mga5