Vulnerabilities > CVE-2021-33560 - Information Exposure Through Discrepancy vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

NVD

Published: 2021-06-08

Updated: 2024-11-21

Summary

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Vulnerable Configurations

Part	Description	Count
Application	Gnupg Gnupg Libgcrypt 1.9.0 Gnupg Libgcrypt 1.9.1 Gnupg Libgcrypt 1.9.2 Gnupg Libgcrypt - Gnupg Libgcrypt 0.1.0 Gnupg Libgcrypt 0.2.0 Gnupg Libgcrypt 0.2.6 Gnupg Libgcrypt 0.2.8 Gnupg Libgcrypt 0.2.10 Gnupg Libgcrypt 0.2.15 Gnupg Libgcrypt 0.2.17 Gnupg Libgcrypt 0.2.18 Gnupg Libgcrypt 0.2.19 Gnupg Libgcrypt 0.3.0 Gnupg Libgcrypt 0.3.1 Gnupg Libgcrypt 0.3.2 Gnupg Libgcrypt 0.3.3 Gnupg Libgcrypt 0.3.4 Gnupg Libgcrypt 0.3.5 Gnupg Libgcrypt 0.4.0 Gnupg Libgcrypt 0.4.1 Gnupg Libgcrypt 0.4.2 Gnupg Libgcrypt 0.4.3 Gnupg Libgcrypt 0.4.4 Gnupg Libgcrypt 0.4.5 Gnupg Libgcrypt 0.9.0 Gnupg Libgcrypt 0.9.1 Gnupg Libgcrypt 0.9.2 Gnupg Libgcrypt 0.9.3 Gnupg Libgcrypt 0.9.4 Gnupg Libgcrypt 0.9.5 Gnupg Libgcrypt 0.9.6 Gnupg Libgcrypt 0.9.7 Gnupg Libgcrypt 0.9.8 Gnupg Libgcrypt 0.9.9 Gnupg Libgcrypt 0.9.10 Gnupg Libgcrypt 0.9.11 Gnupg Libgcrypt 1.0.0 Gnupg Libgcrypt 1.0.1 Gnupg Libgcrypt 1.0.2 Gnupg Libgcrypt 1.0.3 Gnupg Libgcrypt 1.0.4 Gnupg Libgcrypt 1.1.0 Gnupg Libgcrypt 1.1.2 Gnupg Libgcrypt 1.1.3 Gnupg Libgcrypt 1.1.4 Gnupg Libgcrypt 1.1.5 Gnupg Libgcrypt 1.1.6 Gnupg Libgcrypt 1.1.7 Gnupg Libgcrypt 1.1.8 Gnupg Libgcrypt 1.1.9 Gnupg Libgcrypt 1.1.10 Gnupg Libgcrypt 1.1.11 Gnupg Libgcrypt 1.1.12 Gnupg Libgcrypt 1.1.42 Gnupg Libgcrypt 1.1.43 Gnupg Libgcrypt 1.1.44 Gnupg Libgcrypt 1.1.90 Gnupg Libgcrypt 1.1.91 Gnupg Libgcrypt 1.1.92 Gnupg Libgcrypt 1.1.93 Gnupg Libgcrypt 1.1.94 Gnupg Libgcrypt 1.2.0 Gnupg Libgcrypt 1.2.1 Gnupg Libgcrypt 1.2.2 Gnupg Libgcrypt 1.2.3 Gnupg Libgcrypt 1.2.4 Gnupg Libgcrypt 1.3.0 Gnupg Libgcrypt 1.3.1 Gnupg Libgcrypt 1.3.2 Gnupg Libgcrypt 1.4.0 Gnupg Libgcrypt 1.4.1 Gnupg Libgcrypt 1.4.2 Gnupg Libgcrypt 1.4.3 Gnupg Libgcrypt 1.4.4 Gnupg Libgcrypt 1.4.5 Gnupg Libgcrypt 1.4.6 Gnupg Libgcrypt 1.5.0 Gnupg Libgcrypt 1.5.1 Gnupg Libgcrypt 1.5.2 Gnupg Libgcrypt 1.5.3 Gnupg Libgcrypt 1.5.4 Gnupg Libgcrypt 1.5.5 Gnupg Libgcrypt 1.5.6 Gnupg Libgcrypt 1.6.0 Gnupg Libgcrypt 1.6.1 Gnupg Libgcrypt 1.6.2 Gnupg Libgcrypt 1.6.3 Gnupg Libgcrypt 1.6.4 Gnupg Libgcrypt 1.6.5 Gnupg Libgcrypt 1.6.6 Gnupg Libgcrypt 1.7.0 Gnupg Libgcrypt 1.7.1 Gnupg Libgcrypt 1.7.2 Gnupg Libgcrypt 1.7.3 Gnupg Libgcrypt 1.7.4 Gnupg Libgcrypt 1.7.5 Gnupg Libgcrypt 1.7.6 Gnupg Libgcrypt 1.7.7 Gnupg Libgcrypt 1.7.8 Gnupg Libgcrypt 1.7.9 Gnupg Libgcrypt 1.7.10 Gnupg Libgcrypt 1.8.0 Gnupg Libgcrypt 1.8.1 Gnupg Libgcrypt 1.8.2 Gnupg Libgcrypt 1.8.3 Gnupg Libgcrypt 1.8.4 Gnupg Libgcrypt 1.8.5 Gnupg Libgcrypt 1.8.6 Gnupg Libgcrypt 1.8.7	114
Application	Oracle Oracle Communications Cloud Native Core Network Repository Function 1.14.0 Oracle Communications Cloud Native Core Network Repository Function 1.15.0 Oracle Communications Cloud Native Core Network Repository Function 1.15.1 Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.9.0 Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.10.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0 Oracle Communications Cloud Native Core Service Communication Proxy 1.15.0 Oracle Communications Cloud Native Core Binding Support Function 1.11.0	8
OS	Debian Debian Debian Linux 9.0	1
OS	Fedoraproject Fedoraproject Fedora 33 Fedoraproject Fedora 34	2

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References