It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic…
Priority LOW 29CWE-203Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-203.
Summary
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
Why it matters now
EPSS 0.00545 45th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.6.3-2\+deb8u4:*:*:*:*:*:*:* | 1.6.3-2+deb8u4 | Vulnerable | Libgcrypt20 Project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Debian |
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.6.3-2\+deb8u4:*:*:*:*:*:*:* Versions 1.6.3-2+deb8u4 Vulnerable ·Libgcrypt20 Project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Debian
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.7.6-2\+deb9u3:*:*:*:*:*:*:* | 1.7.6-2+deb9u3 | Vulnerable | Libgcrypt20 Project |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Debian |
| cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.8.4-5:*:*:*:*:*:*:* | 1.8.4-5 | Vulnerable | Libgcrypt20 Project |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Running on | Debian |
- cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.7.6-2\+deb9u3:*:*:*:*:*:*:* Versions 1.7.6-2+deb9u3 Vulnerable ·Libgcrypt20 Project
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Debian
- cpe:2.3:a:libgcrypt20_project:libgcrypt20:1.8.4-5:*:*:*:*:*:*:* Versions 1.8.4-5 Vulnerable ·Libgcrypt20 Project
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Running on ·Debian
Remediation
Red Hat 1 advisory
- RHSA-2020:4482 Released 2020-11-04 · Red Hat rating Moderatelibgcrypt security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) libgcrypt-1.8.5-4.el8, libgcrypt-devel-1.8.5-4.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4482 |
Not affected: 3 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13627
- 2026-10-03 Alias added: GHSA-vwvj-6vw9-cw8w
References
Advisory 12
- openSUSE-SU-2019:2161
- [debian-lts-announce] 20190924 [SECURITY] [DLA 1931-1] libgcrypt20 security update
- https://security-tracker.debian.org/tracker/CVE-2019-13627
- https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5
- [oss-security] 20191002 Minerva: ECDSA key recovery from bit-length leakage
- https://minerva.crocs.fi.muni.cz/
- [debian-lts-announce] 20200101 [SECURITY] [DLA 1931-2] libgcrypt20 regression update
- USN-4236-1
- openSUSE-SU-2020:0022
- USN-4236-2
- USN-4236-3
- GLSA-202003-32
Sources
- CVE-2019-13627 · CVE Program
- CVE-2019-13627 · NVD
- FIRST EPSS
- GHSA-vwvj-6vw9-cw8w · GitHub Advisory Database · CC BY 4.0
- CVE-2019-13627 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences