SB2019112915 - Information disclosure in GNU GnuPG
Published: November 29, 2019 Updated: July 17, 2020
Security Bulletin ID
SB2019112915
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2014-3591)
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
Remediation
Install update from vendor's website.