Orta CVSS 4.7 PoC var
CVE-2018-0495: Libgcrypt: güvenlik açığı
Açıklama (NVD)
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Özet bilgiler
- Ürün
- Gnupg Libgcrypt
- CVSS v3.1
- 4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- %0,87 (yüzdelik 59)
- CWE
- CWE-203
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| gnupg-libgcrypt | — | — | 1.7.10 |
| gnupg-libgcrypt | 1.8.0 | — | 1.8.3 |
| canonical-ubuntu-linux | 12.04 | 12.04 | — |
| canonical-ubuntu-linux | 14.04 | 14.04 | — |
| canonical-ubuntu-linux | 16.04 | 16.04 | — |
| canonical-ubuntu-linux | 17.10 | 17.10 | — |
| canonical-ubuntu-linux | 18.04 | 18.04 | — |
| canonical-ubuntu-linux | 18.10 | 18.10 | — |
| debian-debian-linux | 8.0 | 8.0 | — |
| debian-debian-linux | 9.0 | 9.0 | — |
| redhat-ansible-tower | 3.3 | 3.3 | — |
| redhat-enterprise-linux-desktop | 7.0 | 7.0 | — |
| redhat-enterprise-linux-server | 7.0 | 7.0 | — |
| redhat-enterprise-linux-workstation | 7.0 | 7.0 | — |
| oracle-traffic-director | 11.1.1.9.0 | 11.1.1.9.0 | — |
Kaynaklar
- NVD kaydı
- www.securitytracker.com
- www.securitytracker.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- dev.gnupg.org
- git.gnupg.org
- lists.debian.org
- lists.gnupg.org
- usn.ubuntu.com
- usn.ubuntu.com
- usn.ubuntu.com
- usn.ubuntu.com
- usn.ubuntu.com
- usn.ubuntu.com
- www.debian.org
- www.nccgroup.trust
- www.oracle.com
- www.securitytracker.com
- www.securitytracker.com
- access.redhat.com
- CWE-203