Bug 1128531 (CVE-2014-5270) - CVE-2014-5270 libgcrypt: ELGAMAL side-channel attack
Summary: CVE-2014-5270 libgcrypt: ELGAMAL side-channel attack
Alias: CVE-2014-5270
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1128130 1128532 1128533
Blocks: 1128539
TreeView+ depends on / blocked
Reported: 2014-08-11 04:26 UTC by Murray McAllister
Modified: 2021-06-15 15:04 UTC (History)
8 users (show)

Fixed In Version: libgcrypt 1.5.4, libgcrypt 1.6.0
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2021-06-15 15:04:17 UTC

Attachments (Terms of Use)

Description Murray McAllister 2014-08-11 04:26:31 UTC
It was reported that libgcrypt was vulnerable to an ELGAMAL side-channel attack:


In the above reports, this issue presented when using GnuPG with a version of libgcrypt older than 1.6.0 or older than 1.5.4.

Similar to CVE-2013-4242/bug 988589, this could possibly be used to obtain the majority of a private key from memory.



Comment 1 Murray McAllister 2014-08-11 04:30:30 UTC
Created mingw32-libgcrypt tracking bugs for this issue:

Affects: epel-5 [bug 1128532]

Comment 2 Murray McAllister 2014-08-11 04:32:23 UTC
Created mingw-libgcrypt tracking bugs for this issue:

Affects: fedora-all [bug 1128533]

Comment 4 Murray McAllister 2014-08-11 04:50:51 UTC
CVE request:


Comment 5 Werner Koch 2014-08-14 07:28:33 UTC
Has a CVE meanwhile be assigned?  Can't you get one from the Redhat pool?

Comment 6 Murray McAllister 2014-08-18 02:29:11 UTC
MITRE assigned CVE-2014-5270 to the "touching exposed metal on the computer's
chassis". Further details:


Comment 8 Vincent Danen 2014-10-15 20:33:13 UTC

This issue affects the versions of libgcrypt as shipped with Red Hat Enterprise Linux 6 and 7. A future update may address this issue.

This issue affects the version of gnupg and libgcrypt as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 10 Huzaifa S. Sidhpurwala 2015-01-07 06:47:36 UTC
This issue was fixed in libgcrypt-1.5.x via the following commits:


libgcrypt-1.5.4 was released to address this issue.

This issue was fixed in gnupg-1.x via the following commits:


gnupg-1.4.16 was released to address this issue.

Comment 13 Product Security DevOps Team 2021-06-15 15:04:17 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.