CVE-2014-5270

EUVD-2014-5163
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.1 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
Affected Products (NVD)
VendorProductVersion
gnupglibgcrypt
𝑥
≤ 1.5.3
gnupglibgcrypt
1.4.0
gnupglibgcrypt
1.4.3
gnupglibgcrypt
1.4.4
gnupglibgcrypt
1.4.5
gnupglibgcrypt
1.4.6
gnupglibgcrypt
1.5.0
gnupglibgcrypt
1.5.1
gnupglibgcrypt
1.5.2
debiandebian_linux
7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libgcrypt20
bookworm
1.10.1-3
fixed
bullseye
1.8.7-6
fixed
sid
1.11.0-6
fixed
trixie
1.11.0-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gnupg
lucid
Fixed 1.4.10-2ubuntu1.7
released
precise
Fixed 1.4.11-3ubuntu2.7
released
trusty
not-affected
libgcrypt11
lucid
Fixed 1.4.4-5ubuntu2.3
released
precise
Fixed 1.5.0-3ubuntu0.3
released
trusty
Fixed 1.5.3-2ubuntu4.1
released
libgcrypt20
lucid
dne
precise
dne
trusty
dne
Common Weakness Enumeration
References
http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
http://openwall.com/lists/oss-security/2014/08/16/2
http://www.cs.tau.ac.il/~tromer/handsoff/
http://www.debian.org/security/2014/dsa-3024
http://www.debian.org/security/2014/dsa-3073
http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
http://openwall.com/lists/oss-security/2014/08/16/2
http://www.cs.tau.ac.il/~tromer/handsoff/
http://www.debian.org/security/2014/dsa-3024
http://www.debian.org/security/2014/dsa-3073