CVE-2014-3591

Description

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the servers private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Risk Information

Base Score

4.2

MODERATE

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.141

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-3591,CVE-2015-0837,CVE-2015-1607 are affected in GnuPG for windows 1.4.18	Windows
GNU privacy guard - a free PGP replacement (USN-1570-1) gnupg_1.4.11-3ubuntu2.9_i386.deb	Linux
GNU privacy guard - a free PGP replacement (USN-1570-1) gnupg_1.4.11-3ubuntu2.9_amd64.deb	Linux
GNU privacy guard - a free PGP replacement (USN-1570-1) gnupg2_2.0.17-2ubuntu2.12.04.6_i386.deb	Linux
GNU privacy guard - a free PGP replacement (USN-1570-1) gnupg2_2.0.17-2ubuntu2.12.04.6_amd64.deb	Linux
SUSE-SU-2015:1626-1(SUSE Linux Enterprise Desktop 11-SP3 ) libgcrypt11-1.5.0-0.19.1.x86_64.rpm	Linux
SUSE-SU-2015:1626-1(SUSE Linux Enterprise Desktop 11-SP3 ) libgcrypt11-32bit-1.5.0-0.19.1.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234