It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library Fixed Release Info: https://dev.gnupg.org/T4683 Upstream commits: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=b9577f7c89b4327edc09f2231bc8b31521102c79 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=7c2943309d14407b51c8166c4dcecb56a3628567 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=b9577f7c89b4327edc09f2231bc8b31521102c79 (master) https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=7c2943309d14407b51c8166c4dcecb56a3628567 (master) https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=d5407b78cca9f9d318a4f4d2f6ba2b8388584cd9 (1.8.5) https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=db4e9976cc31b314aafad6626b2894e86ee44d60 (1.8.5) Upstream release: https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5 References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=938938 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html http://www.openwall.com/lists/oss-security/2019/10/02/2 https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html https://minerva.crocs.fi.muni.cz/ https://security-tracker.debian.org/tracker/CVE-2019-13627 https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000440.html
Created libgcrypt tracking bugs for this issue: Affects: fedora-all [bug 1764019] Created mingw-libgcrypt tracking bugs for this issue: Affects: epel-7 [bug 1764021] Affects: fedora-all [bug 1764020]
Statement: The versions of libgcrypt shipped with Red Hat Enterprise Linux 5, 6 and 7 do not support ECC, therefore they are not affected by this flaw.
External References: https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5 https://dev.gnupg.org/T4683
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4482 https://access.redhat.com/errata/RHSA-2020:4482
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-13627