Bug 1128531 (CVE-2014-5270)
| Summary: | CVE-2014-5270 libgcrypt: ELGAMAL side-channel attack | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Murray McAllister <mmcallis> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | carnil, erik-fedora, jshort, rdieter, rjones, slawomir, vkrizan, wk |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libgcrypt 1.5.4, libgcrypt 1.6.0 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-06-15 15:04:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1128130, 1128532, 1128533 | ||
| Bug Blocks: | 1128539 | ||
|
Description
Murray McAllister
2014-08-11 04:26:31 UTC
Created mingw32-libgcrypt tracking bugs for this issue: Affects: epel-5 [bug 1128532] Created mingw-libgcrypt tracking bugs for this issue: Affects: fedora-all [bug 1128533] Has a CVE meanwhile be assigned? Can't you get one from the Redhat pool? MITRE assigned CVE-2014-5270 to the "touching exposed metal on the computer's chassis". Further details: http://seclists.org/oss-sec/2014/q3/383 Statement: This issue affects the versions of libgcrypt as shipped with Red Hat Enterprise Linux 6 and 7. A future update may address this issue. This issue affects the version of gnupg and libgcrypt as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. This issue was fixed in libgcrypt-1.5.x via the following commits: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=62e8e1283268f1d3b6d0cfb2fc4e7835bbcdaab6 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=5958574a8285e9d759d7d95418cacd3d352f77a2 libgcrypt-1.5.4 was released to address this issue. This issue was fixed in gnupg-1.x via the following commits: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=cad8216f9a0b33c9dc84ecc4f385b00045e7b496 gnupg-1.4.16 was released to address this issue. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2014-5270 |