Vulnerabilities > Gnupg > Libgcrypt

DATE CVE VULNERABILITY TITLE RISK
2017-06-11 CVE-2017-9526 Information Exposure vulnerability in Gnupg Libgcrypt
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key.
network
high complexity
gnupg CWE-200
5.9
2016-12-13 CVE-2016-6313 Information Exposure vulnerability in multiple products
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
network
low complexity
gnupg debian canonical CWE-200
5.3
2016-04-19 CVE-2015-7511 Information Exposure vulnerability in multiple products
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
high complexity
gnupg debian canonical CWE-200
2.0
2014-10-10 CVE-2014-5270 Information Exposure vulnerability in multiple products
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
local
low complexity
gnupg debian CWE-200
2.1
2013-08-19 CVE-2013-4242 Information Exposure vulnerability in multiple products
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
1.9