[ GLSA 202003-32 ] Libgcrypt

[GLSA]

Gentoo Linux Security Advisory

Title: Libgcrypt: Side-channel attack (GLSA 202003-32)
Severity: low
Exploitable: local
Date: 2020-03-15
Bug(s): #693108
ID: 202003-32

Synopsis

A vulnerability in Libgcrypt could allow a local attacker to
recover sensitive information.


Background

Libgcrypt is a general purpose cryptographic library derived out of
GnuPG.


Affected Packages

Package: dev-libs/libgcrypt
Vulnerable: < 1.8.5
Unaffected: >= 1.8.5
Architectures: All supported architectures


Description

A timing attack was found in the way ECCDSA was implemented in
Libgcrypt.


Impact

A local man-in-the-middle attacker, during signature generation, could
possibly recover the private key.


Workaround

There is no known workaround at this time.

Resolution

All Libgcrypt users should upgrade to the latest version: