CVE-2019-13627 — Observable Discrepancy in Libgcrypt20

CWE-203 — Observable DiscrepancyCWE-362 — Race Condition12 documents7 sources
Severity
6.3MEDIUMNVD
EPSS
0.0%
top 88.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Libgcrypt20 Project Libgcrypt20Debian Libgcrypt20Canonical Ubuntu Linux+1 more
Timeline
PublishedSep 25
Latest updateMay 24

Description

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 1.0 | Impact: 5.2

Affected Packages4 packages

▶debiandebian/libgcrypt20< libgcrypt20 1.8.5-1 (bookworm)
▶NVDlibgcrypt20_project/libgcrypt201.6.3-2\+deb8u4, 1.7.6-2\+deb9u3, 1.8.4-5+2
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 19.04, 19.10

🔴Vulnerability Details

2
GHSA
GHSA-vwvj-6vw9-cw8w: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library↗2022-05-24
▶
OSV
CVE-2019-13627: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library↗2019-09-25
▶

📋Vendor Advisories

5
Ubuntu
Libgcrypt vulnerability↗2020-01-28
▶
Ubuntu
Libgcrypt vulnerability↗2020-01-14
▶
Ubuntu
Libgcrypt vulnerability↗2020-01-13
▶
Red Hat
libgcrypt: ECDSA timing attack allowing private key leak↗2019-10-02
▶
Debian
CVE-2019-13627: libgcrypt20 - It was discovered that there was a ECDSA timing attack in the libgcrypt20 crypto...↗2019
▶

💬Community

4
Bugzilla
CVE-2019-13627 libgcrypt: ECDSA timing attack in the libgcrypt20 cryptographic library [fedora-all]↗2019-10-22
▶
Bugzilla
CVE-2019-13627 mingw-libgcrypt: libgcrypt: ECDSA timing attack in the libgcrypt20 cryptographic library [fedora-all]↗2019-10-22
▶
Bugzilla
CVE-2019-13627 libgcrypt: ECDSA timing attack allowing private key leak↗2019-10-22
▶
Bugzilla
CVE-2019-13627 mingw-libgcrypt: libgcrypt: ECDSA timing attack in the libgcrypt20 cryptographic library [epel-7]↗2019-10-22
▶
CVE-2019-13627 — Observable Discrepancy in Libgcrypt20 | cvebase