UBUNTU-CVE-2014-3591

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2014-3591

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3591.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2014-3591

Related

Published

2014-12-31T00:00:00Z

Modified

2014-12-31T00:00:00Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

References

Affected packages

Ubuntu:14.04:LTS / gnupg

Package

Name: gnupg
Purl: pkg:deb/ubuntu/gnupg@1.4.16-1ubuntu2.3?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.16-1ubuntu2.3

Affected versions

1.*

1.4.14-1ubuntu2

1.4.15-1.1ubuntu1

1.4.15-1.1ubuntu2

1.4.15-2ubuntu1

1.4.16-1ubuntu1

1.4.16-1ubuntu2

1.4.16-1ubuntu2.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "gnupg": "1.4.16-1ubuntu2.3",
            "gpgv": "1.4.16-1ubuntu2.3",
            "gnupg-curl": "1.4.16-1ubuntu2.3",
            "gnupg-udeb": "1.4.16-1ubuntu2.3",
            "gpgv-udeb": "1.4.16-1ubuntu2.3"
        }
    ]
}

Ubuntu:14.04:LTS / libgcrypt11

Package

Name: libgcrypt11
Purl: pkg:deb/ubuntu/libgcrypt11@1.5.3-2ubuntu4.2?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.3-2ubuntu4.2

Affected versions

1.*

1.5.0-3ubuntu3

1.5.3-2ubuntu1

1.5.3-2ubuntu4

1.5.3-2ubuntu4.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libgcrypt11-dbg": "1.5.3-2ubuntu4.2",
            "libgcrypt11-udeb": "1.5.3-2ubuntu4.2",
            "libgcrypt11-doc": "1.5.3-2ubuntu4.2",
            "libgcrypt11": "1.5.3-2ubuntu4.2",
            "libgcrypt11-dev": "1.5.3-2ubuntu4.2"
        }
    ]
}

Ubuntu:14.04:LTS / libgcrypt20

Package

Name: libgcrypt20
Purl: pkg:deb/ubuntu/libgcrypt20@1.6.1-2ubuntu1.14.04.1?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.1-2ubuntu1.14.04.1

Affected versions

1.*

1.6.0-2

1.6.0-2ubuntu2

1.6.1-1

1.6.1-2

1.6.1-2ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libgcrypt20-doc": "1.6.1-2ubuntu1.14.04.1",
            "libgcrypt20-dbg": "1.6.1-2ubuntu1.14.04.1",
            "libgcrypt20": "1.6.1-2ubuntu1.14.04.1",
            "libgcrypt20-dev": "1.6.1-2ubuntu1.14.04.1"
        }
    ]
}