GnuPG - Multiple Vulnerabilities
Summary
DSA-3184-1: gnupg - security update. Affects gnupg versions < 1.4.12-7+deb7u7. Fixed in 1.4.12-7+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuPG, also known as GNU Privacy Guard, is an open-source implementation of the OpenPGP standard. It provides cryptographic privacy and authentication for data communication. GnuPG is widely used for secure email communication and file encryption. However, multiple vulnerabilities have been discovered in GnuPG that could potentially compromise its security.
Vulnerability Detail
The first vulnerability, identified as CVE-2014-3591, involves the Elgamal decryption routine. Researchers from Tel Aviv University discovered a side-channel attack that could be used to exploit this routine. To mitigate this vulnerability, ciphertext blinding was implemented, although it may impact the performance of Elgamal decryption.
The second vulnerability, known as CVE-2015-0837, affects the modular exponentiation routine mpi_powm(). This vulnerability arises from data-dependent timing variations when accessing the internal pre-computed table. An attacker could exploit this side-channel attack to compromise the security of GnuPG.
The third vulnerability, designated as CVE-2015-1606, relates to the keyring parsing code. This code fails to properly reject certain packet types that do not belong in a keyring, leading to an access to freed memory. This vulnerability could be exploited by remote attackers to cause a denial of service (crash) by using crafted keyring files.
How To Fix
Minimum fixed version
1.4.12-7+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in GnuPG, including side-channel attacks and a denial of service vulnerability. It is crucial to upgrade your GnuPG installation to the latest version to mitigate these security risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnupg →
FAQ
GnuPG, or GNU Privacy Guard, is an open-source implementation of the OpenPGP standard. It provides cryptographic privacy and authentication for data communication, commonly used for secure email communication and file encryption.
CVE-2014-3591 is a side-channel attack vulnerability in the Elgamal decryption routine of GnuPG. Exploiting this vulnerability could compromise the security of Elgamal decryption, although it may have a noticeable impact on performance.
CVE-2015-0837 is a side-channel attack vulnerability in the modular exponentiation routine of GnuPG. An attacker could exploit this vulnerability to compromise the security of GnuPG.
CVE-2015-1606 is a vulnerability in the keyring parsing code of GnuPG. It allows remote attackers to cause a denial of service (crash) by using crafted keyring files.
To fix these vulnerabilities, upgrade your GnuPG installation to the latest version. For the stable distribution (wheezy), upgrade to version 1.4.12-7+deb7u7. For the upcoming stable distribution (jessie) and the unstable distribution (sid), upgrade to version 1.4.18-7.
Related vulnerabilities
Recent vulnerabilities recorded for gnupg.
