CVE - CVE-2021-33560

CVE-ID
CVE-2021-33560	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
FEDORA:FEDORA-2021-24d4e06195 URL:https://lists.fedoraproject.org/archives/list/[email protected]/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/ FEDORA:FEDORA-2021-31fdc84207 URL:https://lists.fedoraproject.org/archives/list/[email protected]/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/ GENTOO:GLSA-202210-13 URL:https://security.gentoo.org/glsa/202210-13 MISC:https://dev.gnupg.org/T5305 URL:https://dev.gnupg.org/T5305 MISC:https://dev.gnupg.org/T5328 URL:https://dev.gnupg.org/T5328 MISC:https://dev.gnupg.org/T5466 URL:https://dev.gnupg.org/T5466 MISC:https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61 URL:https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61 MISC:https://www.oracle.com/security-alerts/cpuapr2022.html URL:https://www.oracle.com/security-alerts/cpuapr2022.html MISC:https://www.oracle.com/security-alerts/cpujan2022.html URL:https://www.oracle.com/security-alerts/cpujan2022.html MISC:https://www.oracle.com/security-alerts/cpujul2022.html URL:https://www.oracle.com/security-alerts/cpujul2022.html MISC:https://www.oracle.com/security-alerts/cpuoct2021.html URL:https://www.oracle.com/security-alerts/cpuoct2021.html MLIST:[debian-lts-announce] 20210624 [SECURITY] [DLA 2691-1] libgcrypt20 security update URL:https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html
Assigning CNA
MITRE Corporation
Date Record Created
20210524	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210524)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)