← Zuruck zu CVEs

CVE-2014-3591

MEDIUM

4.2

Beschreibung

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

CVE Details

CVSS v3.1 Bewertung4.2

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorPHYSICAL

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht11/29/2019

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

debian:debian_linuxgnupg:gnupggnupg:libgcrypt

Schwachen (CWE)

CWE-200

Referenzen

http://www.cs.tau.ac.il/~tromer/radioexp/(secalert@redhat.com)

http://www.debian.org/security/2015/dsa-3184(secalert@redhat.com)

http://www.debian.org/security/2015/dsa-3185(secalert@redhat.com)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html(secalert@redhat.com)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html(secalert@redhat.com)

http://www.cs.tau.ac.il/~tromer/radioexp/(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2015/dsa-3184(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2015/dsa-3185(af854a3a-2127-422b-91ae-364da2661108)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.