Red Hat Security AdvisoryRHSA-2013:1457
libgcrypt security update
Released 2013-10-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) libgcrypt-1.4.4-7.el5_10, libgcrypt-1.4.4-7.el5_10.i386, libgcrypt-1.4.4-7.el5_10.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) libgcrypt-1.4.4-7.el5_10, libgcrypt-1.4.4-7.el5_10.i386
- Red Hat Enterprise Linux Desktop (v. 6) libgcrypt-1.4.5-11.el6_4
- Red Hat Enterprise Linux Desktop Optional (v. 6) libgcrypt-1.4.5-11.el6_4, libgcrypt-devel-1.4.5-11.el6_4
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libgcrypt-1.4.4-7.el5_10, libgcrypt-devel-1.4.4-7.el5_10, libgcrypt-devel-1.4.4-7.el5_10.i386
- Red Hat Enterprise Linux HPC Node (v. 6) libgcrypt-1.4.5-11.el6_4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libgcrypt-1.4.5-11.el6_4, libgcrypt-devel-1.4.5-11.el6_4
- Red Hat Enterprise Linux Server (v. 6) libgcrypt-1.4.5-11.el6_4, libgcrypt-1.4.5-11.el6_4.ppc, libgcrypt-devel-1.4.5-11.el6_4 +1
- Red Hat Enterprise Linux Workstation (v. 6) libgcrypt-1.4.5-11.el6_4, libgcrypt-devel-1.4.5-11.el6_4
Fixes 1 record
Priority LOW 11
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
CVSS 2.0LOW 1.9· Local · No auth · Interaction — · EPSS 0.00533 · Published 2013-08-19 · Fixed CWE-200
