Bug 2245218 (CVE-2024-2236)

Summary:	CVE-2024-2236 libgcrypt: vulnerable to Marvin Attack
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdettelb, caswilli, dfreiber, dhalasz, drow, fjansen, hkario, hkataria, jburrell, jjelen, jsamir, kaycoth, kshier, omaciel, orabin, psegedy, rgatica, sbroz, security-response-team, sidakwo, ssorce, sthirugn, tcarlin, vkrizan, vkumar, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2274128, 2274129
Bug Blocks:	2245213

Description Dhananjay Arunesh 2023-10-20 07:00:57 UTC

Libgcrypt is vulnerable to the Marvin attack.

Comment 8 Robb Gatica 2024-03-08 00:42:53 UTC

*** Bug 2268268 has been marked as a duplicate of this bug. ***

Comment 12 Dhananjay Arunesh 2024-04-09 09:41:17 UTC

Created libgcrypt tracking bugs for this issue:

Affects: fedora-all [bug 2274128]


Created mingw-libgcrypt tracking bugs for this issue:

Affects: fedora-all [bug 2274129]