CVE-2016-6313

medium

Description

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

References

http://rhn.redhat.com/errata/RHSA-2016-2674.html

http://www.debian.org/security/2016/dsa-3649

http://www.debian.org/security/2016/dsa-3650

http://www.securityfocus.com/bid/92527

http://www.securitytracker.com/id/1036635

http://www.ubuntu.com/usn/USN-3064-1

http://www.ubuntu.com/usn/USN-3065-1

https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob_plain;f=NEWS

https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html

https://security.gentoo.org/glsa/201610-04

https://security.gentoo.org/glsa/201612-01

Details

Source: MITRE

Published: 2016-12-13

Updated: 2018-01-05

Type: CWE-200

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM