CVE-2018-0495Medium· 4.7▾ SunlitLibgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
libgcrypt < 1.7.10libgcrypt >= 1.8.0, < 1.8.3ubuntu_linux = 12.04ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 17.10ubuntu_linux = 18.04ubuntu_linux = 18.10debian_linux = 8.0debian_linux = 9.0ansible_tower = 3.3enterprise_linux_desktop = 7.0enterprise_linux_server = 7.0enterprise_linux_workstation = 7.0traffic_director = 11.1.1.9.0Upgrade past the affected range:
libgcrypt 1.8.3Connected by shared product, vendor, weakness, or advisory.
CVE-2018-5407Medium· 4.7Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2021-33560High· 7.5Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately
CVE-2026-41989Medium· 6.7Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
CVE-2019-13057Medium· 4.9An issue was discovered in the server in OpenLDAP before 2.4.48
CVE-2019-12904Medium· 5.9In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes
CVE-2019-1563Low· 3.7In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption …