MGASA-2015-0104

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2015-0104.html
Import Source
https://advisories.mageia.org/MGASA-2015-0104.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2015-0104
Related
Published
2015-03-10T16:48:25Z
Modified
2015-03-10T16:39:44Z
Summary
Updated gnupg and libgcrypt packages fix security vulnerabilities
Details

GnuPG before 1.4.19 is vulnerable to a side-channel attack which can potentially lead to an information leak (CVE-2014-3591).

GnuPG before 1.4.19 is vulnerable to a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837).

The gnupg package has been patched to correct these issues.

GnuPG2 is vulnerable to these issues through the libgcrypt library. The issues were fixed in libgcrypt 1.6.3. The libgcrypt package in Mageia, at version 1.5.4, was only vulnerable to the CVE-2014-3591 issue. It has also been patched to correct this issue.

References
Credits

Affected packages

Mageia:4 / gnupg

Package

Name
gnupg
Purl
pkg:rpm/mageia/gnupg?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.16-1.2.mga4

Ecosystem specific 

{
    "section": "core"
}

Mageia:4 / libgcrypt

Package

Name
libgcrypt
Purl
pkg:rpm/mageia/libgcrypt?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.4-1.1.mga4

Ecosystem specific 

{
    "section": "core"
}