CVE-2021-40528

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

References

Affected packages

Git / git.gnupg.org/libgcrypt.git

Affected ranges

Type

GIT

Repo

git://git.gnupg.org/libgcrypt.git

Events

Introduced

Fixed

05422ca24a0391dad2a0b7790a904ce348819c10

Database specific

Show details

{
    "cpe": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.4"
        }
    ]
}

Affected versions

Other

DEVEL-BRANCH-1-1

V-0-2-8

V0-0-0

V0-1-0

V0-2-0

V0-2-10

V0-2-15

V0-2-17

V0-2-18

V0-2-19

V0-2-6

V0-3-0

V0-3-1

V0-3-2

V0-3-3

V0-3-4

V0-3-5

V0-4-0

V0-4-1

V0-4-2

V0-4-3

V0-4-4

V0-4-5

V0-9-0

V0-9-1

V0-9-10

V0-9-11

V0-9-2

V0-9-3

V0-9-4

V0-9-5

V0-9-6

V0-9-7

V0-9-8

V0-9-9

V1-0-0

V1-0-1

V1-0-1-ePit-1

V1-0-2

V1-0-3

V1-0-4

V1-1-0

V1-1-10

V1-1-11

V1-1-12

V1-1-2

V1-1-3

V1-1-4

V1-1-42

V1-1-43

V1-1-44

V1-1-5

V1-1-6

V1-1-7

V1-1-8

V1-1-9

V1-1-90

V1-1-91

V1-1-92

V1-1-93

V1-1-94

V1-2-0

V1-2-1

ecc-integration-done

last-gpl-version

marcus-after-thread-cbs

marcus-before-thread-cbs

now-less-freedom-protected

post-nuke-of-trailing-ws

libgcrypt-1.*

libgcrypt-1.10-base

libgcrypt-1.3.0

libgcrypt-1.3.1

libgcrypt-1.3.2

libgcrypt-1.4.0

libgcrypt-1.4.1

libgcrypt-1.4.1rc1

libgcrypt-1.4.2

libgcrypt-1.4.2rc1

libgcrypt-1.4.2rc2

libgcrypt-1.4.3

libgcrypt-1.4.4

libgcrypt-1.5.0

libgcrypt-1.5.0-beta1

libgcrypt-1.6.0

libgcrypt-1.7.0

libgcrypt-1.7.1

libgcrypt-1.7.2

libgcrypt-1.7.3

libgcrypt-1.8.0

libgcrypt-1.8.1

libgcrypt-1.9-base

libgcrypt-1.9.1

libgcrypt-1.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-40528.json"

Git / github.com/gpg/libgcrypt