oss-security - CVE request: libgcrypt, ELGAMAL side-channel attack

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <53E84B85.20707@redhat.com>
Date: Mon, 11 Aug 2014 14:50:13 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: libgcrypt, ELGAMAL side-channel attack

Hi,

libgcrypt older than 1.6.0, and older than 1.5.4, are vulnerable to a 
ELGAMAL side-channel attack:

http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html

https://lists.fedoraproject.org/pipermail/security-team/2014-August/000055.html

(This may be similar sort of issue to CVE-2013-4242.)

Can a CVE please be a assigned if one has not been already?

Thanks,

--
Murray McAllister / Red Hat Product Security

https://bugzilla.redhat.com/show_bug.cgi?id=988589
https://bugzilla.redhat.com/show_bug.cgi?id=1128531

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.