CVE-2017-7526
MEDIUM6.8EPSS 2.8%libgcrypt11 - security update
Published: 7/26/2018Modified: 11/19/2025
Also known as:ALPINE-CVE-2017-7526DEBIAN-CVE-2017-7526DLA-1015-1
Description
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
Affected packages (7)
- Alpine/gnupg1from 0, < 1.4.23-r0
- Debian/gnupgfrom 0, < 1.4.12-7+deb7u9
- Debian/gnupgfrom 0, < 1.4.18-7+deb8u4
- Debian/gnupg1from 0, < 1.4.22-1
- Debian/libgcrypt11from 0, < 1.5.0-5+deb7u6
- Debian/libgcrypt20from 0, < 1.7.8-1
- Debian/libgcrypt20from 0, < 1.6.3-2+deb8u4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.8 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |