It was reported that libgcrypt was vulnerable to an ELGAMAL side-channel attack:
In the above reports, this issue presented when using GnuPG with a version of libgcrypt older than 1.6.0 or older than 1.5.4.
Similar to CVE-2013-4242/bug 988589, this could possibly be used to obtain the majority of a private key from memory.
Created mingw32-libgcrypt tracking bugs for this issue:
Affects: epel-5 [bug 1128532]
Created mingw-libgcrypt tracking bugs for this issue:
Affects: fedora-all [bug 1128533]
Has a CVE meanwhile be assigned? Can't you get one from the Redhat pool?
MITRE assigned CVE-2014-5270 to the "touching exposed metal on the computer's
chassis". Further details:
This issue affects the versions of libgcrypt as shipped with Red Hat Enterprise Linux 6 and 7. A future update may address this issue.
This issue affects the version of gnupg and libgcrypt as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
This issue was fixed in libgcrypt-1.5.x via the following commits:
libgcrypt-1.5.4 was released to address this issue.
This issue was fixed in gnupg-1.x via the following commits:
gnupg-1.4.16 was released to address this issue.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):