← Voltar para CVEs

CVE-2014-3591

MEDIUM

4.2

Descricao

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Detalhes CVE

Pontuacao CVSS v3.14.2

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Vetor de ataquePHYSICAL

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado11/29/2019

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

debian:debian_linuxgnupg:gnupggnupg:libgcrypt

Fraquezas (CWE)

CWE-200

Referencias

http://www.cs.tau.ac.il/~tromer/radioexp/(secalert@redhat.com)

http://www.debian.org/security/2015/dsa-3184(secalert@redhat.com)

http://www.debian.org/security/2015/dsa-3185(secalert@redhat.com)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html(secalert@redhat.com)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html(secalert@redhat.com)

http://www.cs.tau.ac.il/~tromer/radioexp/(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2015/dsa-3184(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2015/dsa-3185(af854a3a-2127-422b-91ae-364da2661108)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.