drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in libgcrypt11
Name: |
Zwei Probleme in libgcrypt11 |
|
ID: |
DSA-3185-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian wheezy |
|
Datum: |
Do, 12. März 2015, 20:15 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837 |
|
Applikationen: |
libgcrypt |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3185-1 security@debian.org http://www.debian.org/security/ Alessandro Ghedini March 12, 2015 http://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : libgcrypt11 CVE ID : CVE-2014-3591 CVE-2015-0837
Multiple vulnerabilities were discovered in libgcrypt:
CVE-2014-3591
The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University. Ciphertext blinding was enabled to counteract it. Note that this may have a quite noticeable impact on Elgamal decryption performance.
CVE-2015-0837
The modular exponentiation routine mpi_powm() was susceptible to a side-channel attack caused by data-dependent timing variations when accessing its internal pre-computed table.
For the stable distribution (wheezy), these problems have been fixed in version 1.5.0-5+deb7u3.
We recommend that you upgrade your libgcrypt11 packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBCAAGBQJVAdKBAAoJEFb2GnlAHawEGYoIAJDR41vTx6S3mVQBcaaZ+p3Y kZiMLHqySwXhoLC1T5/X3vwuNk1nO/rbAJsvLo27dRJGCqd7EvhyUYJ9dmo9resN 9ryNUh2e0T6EJ/rt3ytldxE4fRwGL68yIQU7aGcyw1fxh26LHA2NHV+FDdVTylse EM+HuC2sBLijC7MYsYq9iR0TQi8jiQJqVAijlz8ArvsuOFvqXqqBGsmOplW6cJpP 5y4C9h2tl0pT0JOC1mZEqmalSqCPdxHRNMI8mnz4V/QFvxkAE0kvlLxTGJW5zwje PO/2eilKsCMqb/q1ccBWsKp4q7OL8f5jAfIy4Aurx014PCp71NxGvzzaTnK3yjA= =+M3h -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: https://lists.debian.org/20150312175356.391325A210@kinkhorst.com
|
|
|
|