CVE-2021-33560

Published: Jun 8, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Affected (13)

Products: Gnupg: Libgcrypt · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Gnupg: Libgcrypt · Debian: Debian Linux · Fedoraproject: Fedora · Oracle: Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Network Function Cloud Native Environment, Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Slice Selection Function, Communications Cloud Native Core Service Communication Proxy

1 product

1 product

1 product

5 products

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Network Function Cloud Native Environment

Communications Cloud Native Core Network Repository Function

Communications Cloud Native Core Network Slice Selection Function

Communications Cloud Native Core Service Communication Proxy

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Gnupg Libgcrypt	Before 1.8.8
Gnupg Libgcrypt	From 1.9.0 to 1.9.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Binding Support Function	Version 1.11.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.9.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.14.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.0
Oracle Communications Cloud Native Core Network Repository Function	Version 1.15.1
Oracle Communications Cloud Native Core Network Slice Selection Function	Version 1.8.0
Oracle Communications Cloud Native Core Service Communication Proxy	Version 1.15.0

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

References (24)

https://dev.gnupg.org/T5305

Source: cve@mitre.org

Release NotesVendor Advisory

https://dev.gnupg.org/T5328

Source: cve@mitre.org

Vendor Advisory

https://dev.gnupg.org/T5466

Source: cve@mitre.org

Release NotesVendor Advisory

https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61

Source: cve@mitre.org

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202210-13

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

Third Party Advisory

https://dev.gnupg.org/T5305

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://dev.gnupg.org/T5328

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://dev.gnupg.org/T5466

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202210-13

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.