Log in Start free

Vulnerability · Published Jun 8, 2021 · Assigned by mitre

CVE-2021-33560

High 7.5

In plain English

A high-severity security flaw in the libgcrypt package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libgcrypt1.8.5-6.el8ALSA-2021:4409
AlmaLinux:8libgcrypt-devel1.8.5-6.el8ALSA-2021:4409
Alpine:v3.20libgcrypt1.9.4-r0ALPINE-CVE-2021-33560
Alpine:v3.21libgcrypt1.9.4-r0ALPINE-CVE-2021-33560
Alpine:v3.22libgcrypt1.9.4-r0ALPINE-CVE-2021-33560
Alpine:v3.23libgcrypt1.9.4-r0ALPINE-CVE-2021-33560
Alpine:v3.24libgcrypt1.9.4-r0ALPINE-CVE-2021-33560
Debian:12libgcrypt201.9.4-2DEBIAN-CVE-2021-33560
Debian:13libgcrypt201.9.4-2DEBIAN-CVE-2021-33560
Debian:14libgcrypt201.9.4-2DEBIAN-CVE-2021-33560
Rocky Linux:8libgcrypt0:1.8.5-6.el8RLSA-2021:4409
Ubuntu:22.04:LTSlibgcrypt201.8.7-5ubuntu2UBUNTU-CVE-2021-33560

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-325 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References