CVE-2017-7526

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-7526
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability : 1.6 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/99338 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038915 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526 Issue Tracking Patch Third Party Advisory
https://eprint.iacr.org/2017/627 Third Party Advisory
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=78130828e9a140a9de4dafadbc844dbb64cb709a
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=8725c99ffa41778f382ca97233183bcd687bb0ce
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=e6a3dc9900433bbc8ad362a595a3837318c28fa9
https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html Mailing List Vendor Advisory
https://usn.ubuntu.com/3733-1/ Third Party Advisory
https://usn.ubuntu.com/3733-2/ Third Party Advisory
https://www.debian.org/security/2017/dsa-3901 Third Party Advisory
https://www.debian.org/security/2017/dsa-3960 Third Party Advisory
http://www.securityfocus.com/bid/99338 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038915 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526 Issue Tracking Patch Third Party Advisory
https://eprint.iacr.org/2017/627 Third Party Advisory
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=78130828e9a140a9de4dafadbc844dbb64cb709a
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=8725c99ffa41778f382ca97233183bcd687bb0ce
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=e6a3dc9900433bbc8ad362a595a3837318c28fa9
https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html Mailing List Vendor Advisory
https://usn.ubuntu.com/3733-1/ Third Party Advisory
https://usn.ubuntu.com/3733-2/ Third Party Advisory
https://www.debian.org/security/2017/dsa-3901 Third Party Advisory
https://www.debian.org/security/2017/dsa-3960 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 03:32

Type Values Removed Values Added
CVSS v2 : 4.3
v3 : 6.8 		v2 : 4.3
v3 : 6.1
References () http://www.securityfocus.com/bid/99338 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/99338 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1038915 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1038915 - Third Party Advisory, VDB Entry
References () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526 - Issue Tracking, Patch, Third Party Advisory
References () https://eprint.iacr.org/2017/627 - Third Party Advisory () https://eprint.iacr.org/2017/627 - Third Party Advisory
References () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=78130828e9a140a9de4dafadbc844dbb64cb709a - () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=78130828e9a140a9de4dafadbc844dbb64cb709a -
References () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=8725c99ffa41778f382ca97233183bcd687bb0ce - () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=8725c99ffa41778f382ca97233183bcd687bb0ce -
References () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=e6a3dc9900433bbc8ad362a595a3837318c28fa9 - () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=e6a3dc9900433bbc8ad362a595a3837318c28fa9 -
References () https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html - Mailing List, Vendor Advisory () https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html - Mailing List, Vendor Advisory
References () https://usn.ubuntu.com/3733-1/ - Third Party Advisory () https://usn.ubuntu.com/3733-1/ - Third Party Advisory
References () https://usn.ubuntu.com/3733-2/ - Third Party Advisory () https://usn.ubuntu.com/3733-2/ - Third Party Advisory
References () https://www.debian.org/security/2017/dsa-3901 - Third Party Advisory () https://www.debian.org/security/2017/dsa-3901 - Third Party Advisory
References () https://www.debian.org/security/2017/dsa-3960 - Third Party Advisory () https://www.debian.org/security/2017/dsa-3960 - Third Party Advisory

07 Nov 2023, 02:50

Type Values Removed Values Added
References
  • {'url': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=78130828e9a140a9de4dafadbc844dbb64cb709a', 'name': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=78130828e9a140a9de4dafadbc844dbb64cb709a', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • {'url': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=8725c99ffa41778f382ca97233183bcd687bb0ce', 'name': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=8725c99ffa41778f382ca97233183bcd687bb0ce', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • {'url': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=e6a3dc9900433bbc8ad362a595a3837318c28fa9', 'name': 'https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=e6a3dc9900433bbc8ad362a595a3837318c28fa9', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=e6a3dc9900433bbc8ad362a595a3837318c28fa9 -
  • () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=78130828e9a140a9de4dafadbc844dbb64cb709a -
  • () https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=8725c99ffa41778f382ca97233183bcd687bb0ce -
Information

Published : 2018-07-26 13:29

Updated : 2024-11-21 03:32

NVD link : CVE-2017-7526

Mitre link : CVE-2017-7526

CVE.ORG link : CVE-2017-7526

JSON object : View

Products Affected

canonical

  • ubuntu_linux

debian

  • debian_linux

gnupg

  • libgcrypt
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-310

Cryptographic Issues


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024