Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Debian 7: DLA-1015-1 Critical Key Exposure in Libgcrypt11 Cryptography

debian lts
Calendar Grey July 6, 2017
Scroller Debian Lts
Libgcrypt11 security vulnerability resolved in update for Debian 7 Wheezy. Ensure to upgrade to avert potential cryptographic risks.
It was discovered that there was a key disclosure vulnerability in libgcrypt11 a library of cryptographic routines: It is well known that constant-time implementations of modular e...
Topics%20covered

Topics Covered

security advisory critical debian cryptographic threat libgcrypt11 key disclosure

Summary

It is well known that constant-time implementations of modular exponentiation
cannot use sliding windows. However, software libraries such as Libgcrypt,
used by GnuPG, continue to use sliding windows. It is widely believed that,
even if the complete pattern of squarings and multiplications is observed
through a side-channel attack, the number of exponent bits leaked is not
sufficient to carry out a full key-recovery attack against RSA.
Specifically, 4-bit sliding windows leak only 40% of the bits, and 5-bit
sliding windows leak only 33% of the bits.

-- Sliding right into disaster: Left-to-right sliding windows leak


For Debian 7 "Wheezy", this issue has been fixed in libgcrypt11 version
1.5.0-5+deb7u6.

We recommend that you upgrade your libgcrypt11 packages.


Regards,

- --
,'`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-



Severity
critical
Lowest
Low
Medium
High
Critical

Package: libgcrypt11
Version: 1.5.0-5+deb7u6
CVE ID: CVE-2017-7526

Topics%20covered

Topics Covered

security advisory critical debian cryptographic threat libgcrypt11 key disclosure

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.