CVE-2021-33560 — פרטי פגיעות

תיאור (מקור, אנגלית)

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

מדדים

CVSS 3.1: 7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — סבירות ניצול: 2% (אחוזון 100) נכון ל-18/10/2026
CWE: CWE-203, CWE-325

מוצרים מושפעים

gnupg: libgcrypt; debian: debian linux; fedoraproject: fedora; oracle: communications cloud native core binding support function; oracle: communications cloud native core network function cloud native environment; oracle: communications cloud native core network repository function; oracle: communications cloud native core network slice selection function; oracle: communications cloud native core service communication proxy

קישורים

https://dev.gnupg.org/T5305 Release NotesVendor Advisory
https://dev.gnupg.org/T5328 Vendor Advisory
https://dev.gnupg.org/T5466 Release NotesVendor Advisory
https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61 PatchVendor Advisory
https://dev.gnupg.org/T5305 Release NotesVendor Advisory
https://dev.gnupg.org/T5328 Vendor Advisory
https://dev.gnupg.org/T5466 Release NotesVendor Advisory
https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61 PatchVendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory

תיאור (מקור, אנגלית)

מדדים

מוצרים מושפעים

קישורים

נגישות