Moderate: libgcrypt security and bug fix update
Summary
ALSA-2021:4409: Moderate: libgcrypt security and bug fix update. Affects libgcrypt versions < 1.8.5-6.el8. Fixed in 1.8.5-6.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libgcrypt library is a general-purpose cryptographic library that provides implementations of various cryptographic algorithms. It is used by applications to perform encryption, decryption, digital signatures, and other cryptographic operations. The library is widely used in the AlmaLinux ecosystem.
Vulnerability Detail
The libgcrypt library is affected by a moderate security vulnerability (CVE-2021-33560). The vulnerability arises from a mishandling of ElGamal encryption, as the library lacks exponent blinding to address a side-channel attack against mpi_powm. This vulnerability could potentially be exploited by an attacker to gain unauthorized access to sensitive information or perform cryptographic attacks. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
1.8.5-6.el8
This is the first release that contains the fix.
sudo dnf update libgcryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the libgcrypt library in AlmaLinux is affected by a moderate security vulnerability. Users are advised to update the libgcrypt package to the latest version to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgcrypt →
FAQ
Libgcrypt is a general-purpose cryptographic library used for encryption, decryption, digital signatures, and other cryptographic operations.
The vulnerability could potentially allow an attacker to gain unauthorized access to sensitive information or perform cryptographic attacks.
To fix this vulnerability, update the libgcrypt package to version 1.8.5-6.el8 or later using the package manager of your AlmaLinux system.
No specific workarounds have been mentioned for this vulnerability. It is recommended to apply the official fix by updating the libgcrypt package.
More information about this vulnerability can be found in the CVE page linked in the References section of the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgcrypt.
