Vulnerability in gnupg - security update
Summary
DLA-1080-1: gnupg - security update. Affects gnupg versions < 1.4.12-7+deb7u9. Fixed in 1.4.12-7+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gnupg is a widely used open-source encryption software that provides cryptographic privacy and authentication for data communication. It is commonly used for secure email communication and file encryption. The vulnerability in gnupg allows for a local side-channel attack, which can lead to the full recovery of RSA-1024 keys.
Vulnerability Detail
The vulnerability in gnupg arises from a local side-channel attack, which can be exploited to recover RSA-1024 keys. This attack is possible due to certain implementation flaws in the software. An attacker with local access to the system can leverage this vulnerability to obtain sensitive cryptographic keys, compromising the security of encrypted data. The attack technique is described in detail in the provided research paper.
How To Fix
Minimum fixed version
1.4.12-7+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the gnupg package to the patched version.
Conclusion
The vulnerability in gnupg allows for a local side-channel attack, enabling the recovery of RSA-1024 keys. To mitigate this vulnerability, it is essential to upgrade the gnupg package to version 1.4.12-7+deb7u9 or later. Failure to apply the necessary patches can result in the compromise of encrypted data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnupg →
FAQ
The vulnerability allows for the recovery of RSA-1024 keys, which can compromise the security of encrypted data. An attacker with local access to the system can exploit this vulnerability to obtain sensitive cryptographic keys.
Users of gnupg version 1.4.12-7 and earlier on Debian 7 Wheezy are affected by this vulnerability.
No, this vulnerability can only be exploited by an attacker with local access to the system.
This vulnerability specifically affects gnupg version 1.4.12-7 on Debian 7 Wheezy. Other versions or distributions may have different vulnerabilities or may not be affected at all.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is crucial to apply the recommended fix to prevent potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for gnupg.
