Home

CVE-2019-13627

Description

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

Risk Information

Base Score
6.3
MODERATE
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.039

Associated Vulnerability

VulnerabilityOS Platform
SUSE-SU-2019:2510-1(SUSE Linux Enterprise Desktop 12-SP4 ) libgcrypt-debugsource-1.6.1-16.68.1.x86_64.rpmLinux
SUSE-SU-2019:2510-1(SUSE Linux Enterprise Desktop 12-SP4 ) libgcrypt20-1.6.1-16.68.1.x86_64.rpmLinux
SUSE-SU-2019:2510-1(SUSE Linux Enterprise Desktop 12-SP4 ) libgcrypt20-32bit-1.6.1-16.68.1.x86_64.rpmLinux
SUSE-SU-2019:2510-1(SUSE Linux Enterprise Desktop 12-SP4 ) libgcrypt20-debuginfo-1.6.1-16.68.1.x86_64.rpmLinux
SUSE-SU-2019:2510-1(SUSE Linux Enterprise Desktop 12-SP4 ) libgcrypt20-debuginfo-32bit-1.6.1-16.68.1.x86_64.rpmLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.1-4ubuntu1.2_i386.debLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.1-4ubuntu1.2_amd64.debLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.4-3ubuntu1.1_i386.debLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.4-3ubuntu1.1_amd64.debLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.4-5ubuntu2.1_i386.debLinux
LGPL Crypto library (USN-4236-1) libgcrypt20_1.8.4-5ubuntu2.1_amd64.debLinux
LGPL Crypto library (USN-4236-2) libgcrypt20_1.6.5-2ubuntu0.6_i386.debLinux
LGPL Crypto library (USN-4236-2) libgcrypt20_1.6.5-2ubuntu0.6_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234