CVE-2024-2236

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

References

Affected packages

Debian:11 / libgcrypt20

Package

Name: libgcrypt20
Purl: pkg:deb/debian/libgcrypt20?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.7-6

1.9.0-1

1.9.1-1

1.9.2~beta16-1

1.9.2-1

1.9.3-1

1.9.4-1

1.9.4-2

1.9.4-3

1.9.4-4

1.9.4-5

1.10.0-1

1.10.0-2

1.10.1-1

1.10.1-2

1.10.1-3

1.10.2-1

1.10.2-2

1.10.2-2+loong64

1.10.2-3

1.10.3-1

1.10.3-2

1.10.3-3

1.11.0~beta450-1

1.11.0-1

1.11.0-2

1.11.0-3

1.11.0-4

1.11.0-5

1.11.0-6

1.11.0-7

1.11.0+git20250114-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / libgcrypt20

Package

Name: libgcrypt20
Purl: pkg:deb/debian/libgcrypt20?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.1-3

1.10.2-1

1.10.2-2

1.10.2-2+loong64

1.10.2-3

1.10.3-1

1.10.3-2

1.10.3-3

1.11.0~beta450-1

1.11.0-1

1.11.0-2

1.11.0-3

1.11.0-4

1.11.0-5

1.11.0-6

1.11.0-7

1.11.0+git20250114-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / libgcrypt20

Package

Name: libgcrypt20
Purl: pkg:deb/debian/libgcrypt20?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.1-3

1.10.2-1

1.10.2-2

1.10.2-2+loong64

1.10.2-3

1.10.3-1

1.10.3-2

1.10.3-3

1.11.0~beta450-1

1.11.0-1

1.11.0-2

1.11.0-3

1.11.0-4

1.11.0-5

1.11.0-6

1.11.0-7

1.11.0+git20250114-1

Ecosystem specific

{
    "urgency": "unimportant"
}