CVE - CVE-2017-7526

CVE-ID
CVE-2017-7526	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:99338 URL:http://www.securityfocus.com/bid/99338 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526 CONFIRM:https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=78130828e9a140a9de4dafadbc844dbb64cb709a CONFIRM:https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=8725c99ffa41778f382ca97233183bcd687bb0ce CONFIRM:https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=e6a3dc9900433bbc8ad362a595a3837318c28fa9 DEBIAN:DSA-3901 URL:https://www.debian.org/security/2017/dsa-3901 DEBIAN:DSA-3960 URL:https://www.debian.org/security/2017/dsa-3960 MISC:https://eprint.iacr.org/2017/627 MLIST:[gnupg-announce] 20170629 Libgcrypt 1.7.8 released to fix CVE-2017-7526 URL:https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html SECTRACK:1038915 URL:http://www.securitytracker.com/id/1038915 UBUNTU:USN-3733-1 URL:https://usn.ubuntu.com/3733-1/ UBUNTU:USN-3733-2 URL:https://usn.ubuntu.com/3733-2/
Assigning CNA
Red Hat, Inc.
Date Record Created
20170405	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20170405)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)