USN-3733-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-3733-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3733-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/USN-3733-1
Upstream
Related
Published
2018-08-07T02:50:28.182820Z
Modified
2025-10-13T04:34:41Z
Summary
gnupg vulnerability
Details

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that GnuPG is vulnerable to a cache side-channel attack. A local attacker could use this attack to recover RSA private keys.

References

Affected packages

Ubuntu:14.04:LTS / gnupg

Package

Name
gnupg
Purl
pkg:deb/ubuntu/gnupg@1.4.16-1ubuntu2.6?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.16-1ubuntu2.6

Affected versions

1.*

1.4.14-1ubuntu2
1.4.15-1.1ubuntu1
1.4.15-1.1ubuntu2
1.4.15-2ubuntu1
1.4.16-1ubuntu1
1.4.16-1ubuntu2
1.4.16-1ubuntu2.1
1.4.16-1ubuntu2.3
1.4.16-1ubuntu2.4
1.4.16-1ubuntu2.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.4.16-1ubuntu2.6",
            "binary_name": "gnupg"
        },
        {
            "binary_version": "1.4.16-1ubuntu2.6",
            "binary_name": "gnupg-curl"
        },
        {
            "binary_version": "1.4.16-1ubuntu2.6",
            "binary_name": "gpgv"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2017-7526"
        }
    ],
    "ecosystem": "Ubuntu:14.04:LTS"
}

Ubuntu:16.04:LTS / gnupg

Package

Name
gnupg
Purl
pkg:deb/ubuntu/gnupg@1.4.20-1ubuntu3.3?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.20-1ubuntu3.3

Affected versions

1.*

1.4.18-7ubuntu1
1.4.19-6ubuntu1
1.4.20-1ubuntu1
1.4.20-1ubuntu2
1.4.20-1ubuntu3
1.4.20-1ubuntu3.1
1.4.20-1ubuntu3.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.4.20-1ubuntu3.3",
            "binary_name": "gnupg"
        },
        {
            "binary_version": "1.4.20-1ubuntu3.3",
            "binary_name": "gnupg-curl"
        },
        {
            "binary_version": "1.4.20-1ubuntu3.3",
            "binary_name": "gpgv"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2017-7526"
        }
    ],
    "ecosystem": "Ubuntu:16.04:LTS"
}