Vulnerability in libgcrypt11 - Security Update
Summary
DLA-600-1: libgcrypt11 - security update. Affects libgcrypt11 versions < 1.5.0-5+deb7u5. Fixed in 1.5.0-5+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgcrypt11 is a crypto library used in the Debian 7 Wheezy ecosystem. It provides various cryptographic algorithms and functions for secure communication and data protection. However, a weakness has been discovered in the random number generator of libgcrypt11.
Vulnerability Detail
The vulnerability, identified as CVE-2016-6313, stems from a bug in the mixing functions of Libgcrypt's random number generator. If an attacker manages to obtain 4640 bits from the RNG, they can easily predict the next 160 bits of output. While existing RSA keys are not weakened, the prediction of private keys from public information for DSA and Elgamal keys is also unlikely.
How To Fix
Minimum fixed version
1.5.0-5+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgcrypt11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, libgcrypt11 in Debian 7 Wheezy is vulnerable to a weakness in its random number generator. Upgrading to version 1.5.0-5+deb7u5 or later is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgcrypt11 →
FAQ
libgcrypt11 is a crypto library used for cryptographic operations in the Debian 7 Wheezy ecosystem.
Existing RSA keys are not weakened by this vulnerability.
While it is unlikely, this vulnerability does not completely rule out the possibility of predicting private keys from public information for DSA and Elgamal keys.
To fix this vulnerability, upgrade the libgcrypt11 package to version 1.5.0-5+deb7u5 or later.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libgcrypt11.
