Note:
This project will be discontinued after December 13, 2021. [more]
2019-11-29
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Products | Debian_linux, Gnupg, Libgcrypt |
Type | Information Exposure Through Discrepancy (CWE-203) |
First patch | - None (likely due to unavailable code) |
Links |
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html
• https://ieeexplore.ieee.org/document/7163050 • https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html • http://www.debian.org/security/2015/dsa-3185 • http://www.debian.org/security/2015/dsa-3184 |