CVE-2017-0379

Published: Aug 29, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Affected (2)

Products: Gnupg: Libgcrypt · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnupg Libgcrypt	Up to 1.8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (22)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: security@debian.org

http://www.securityfocus.com/bid/100503

Source: security@debian.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041294

Source: security@debian.org

https://bugs.debian.org/873383

Source: security@debian.org

Issue TrackingThird Party Advisory

https://eprint.iacr.org/2017/806

Source: security@debian.org

Mailing ListThird Party Advisory

https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=da780c8183cccc8f533c8ace8211ac2cb2bdee7b

Source: security@debian.org

https://lists.debian.org/debian-security-announce/2017/msg00221.html

Source: security@debian.org

Mailing ListPatchThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2017-0379

Source: security@debian.org

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20180726-0002/

Source: security@debian.org

https://www.debian.org/security/2017/dsa-3959

Source: security@debian.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: security@debian.org

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html