EulerOS Virtualization 2.5.3 : openssl (EulerOS-SA-2019-1185)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigat...

openSUSE Security Update : libgcrypt (openSUSE-2019-540)

This update for libgcrypt fixes the following issue : The following security issue was fixed : - CVE-2018-0495: Fixed a novel side-channel attack, by enabling blinding for ECDSA signatures bsc1097410 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenabl...

Important Photon OS Security Update - PHSA-2019-0208

Updates of 'docker', 'libgcrypt', 'glibc' packages of Photon OS have been released...

Photon OS 2.0: Libgcrypt PHSA-2018-2.0-0091

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0091. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Libgcrypt PHSA-2017-0040

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0040. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121743...

Photon OS 1.0: Libgcrypt PHSA-2017-0013

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0013. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121685...

The vulnerability of the _gcry_ecc_ecdsa_sign function in the Libgcrypt cryptographic library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the gcryeccecdsasign function “cipher/ecc-ecdsa.c” in the cryptographic library Libgcrypt relates to the possibility of determining plausible values for basic parameters of a next digital signature by iterating through cache values and evaluating computational costs. This cou...

Photon OS 1.0: Libgcrypt PHSA-2018-1.0-0182

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0182. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: Vulnerability in libgcrypt affects IBM Chassis Management Module (CVE-2017-7526)

Summary IBM Chassis Management Module has addressed the following vulnerability in libgcrypt. Vulnerability Details Summary IBM Chassis Management Module has addressed the following vulnerability in libgcrypt. Vulnerability Details: CVEID: CVE-2017-7526 Description: Libgcrypt could allow a remote...

Information Leakage

The libgcrypt library is vulnerable to information leakage. The vulnerability exists because of a flaw in the libgcrypt PRNG Pseudo-Random Number Generator, leaking the first 580 bytes of the PRNG output which allows the attacker to guess the following 20 bytes...

Information Disclosure

libgcrypt is vulnerable to information disclosure attacks. The vulnerability exists as GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka...

Fedora 28 : libgcrypt (2018-1ea5beb4cf)

Minor security update to version 1.8.3 from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2018:1993-1)

This update for libgcrypt fixes the following issue: The following security issue was fixed : - CVE-2018-0495: Fixed a novel side-channel attack, by enabling blinding for ECDSA signatures bsc1097410 Note that Tenable Network Security has extracted the preceding description block directly from the...

SUSE SLES12 Security Update : compat-libgcrypt11 (SUSE-SU-2017:1866-1)

This update for libgcrypt fixes the following security issue : - CVE-2017-7526: Hardening against local side-channel attack. bsc1046607 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in OpenSSL. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server duri...

Medium: openssl

Issue Overview: Libgcrypt allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2018:2452-2)

This update for libgcrypt fixes the following issues : The following security vulnerability was addressed : CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: Extended the fipsdrv dsa-sign and dsa-verify...

SUSE-SU-2018:2452-2 Security update for libgcrypt

This update for libgcrypt fixes the following issues: The following security vulnerability was addressed: - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: - Extended the fipsdrv dsa-sign and dsa-veri...

Security Bulletin: A Security Vulnerability could affect IBM® Cloud Private (CVE-2017-7526)

Summary Users of IBM Cloud Private could be affected by a vulnerability in MongoDB Vulnerability Details CVEID: CVE-2017-7526 DESCRIPTION: Libgcrypt could allow a remote attacker to obtain sensitive information, caused by a cache side-channel attack when using left-to-right sliding window method ...

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. T...