openSUSE Security Update : libgcrypt (openSUSE-SU-2013:1294-1)

Medium Nessus Plugin ID 75105


The remote openSUSE host is missing a security update.


libgcrypt was updated to 1.5.3 [bnc#831359] to fix a security issue, bugs and get some new features :

Security issue fixed :

- Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. See <>.

- contains changes from 1.5.2

- The upstream sources now contain the IDEA algorithm, dropping: idea.c.gz libgcrypt-1.5.0-idea.patch libgcrypt-1.5.0-idea_codecleanup.patch

- Made the Padlock code work again (regression since 1.5.0).

- Fixed alignment problems for Serpent.

- Fixed two bugs in ECC computations.

- add GPL3.0+ to License tag because of dumpsexp (bnc#810759)

- contains changes from 1.5.1

- Allow empty passphrase with PBKDF2.

- Do not abort on an invalid algorithm number in gcry_cipher_get_algo_keylen and gcry_cipher_get_algo_blklen.

- Fixed some Valgrind warnings.

- Fixed a problem with select and high fd numbers.

- Improved the build system

- Various minor bug fixes.

- Interface changes relative to the 1.5.0 release:


Update the affected libgcrypt packages.

See Also

Plugin Details

Severity: Medium

ID: 75105

File Name: openSUSE-2013-627.nasl

Version: $Revision: 1.2 $

Type: local

Agent: unix

Published: 2014/06/13

Modified: 2016/04/28

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libgcrypt-debugsource, p-cpe:/a:novell:opensuse:libgcrypt-devel, p-cpe:/a:novell:opensuse:libgcrypt-devel-32bit, p-cpe:/a:novell:opensuse:libgcrypt-devel-debuginfo, p-cpe:/a:novell:opensuse:libgcrypt-devel-debuginfo-32bit, p-cpe:/a:novell:opensuse:libgcrypt11, p-cpe:/a:novell:opensuse:libgcrypt11-32bit, p-cpe:/a:novell:opensuse:libgcrypt11-debuginfo, p-cpe:/a:novell:opensuse:libgcrypt11-debuginfo-32bit, cpe:/o:novell:opensuse:12.2, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/07/26

Reference Information

OSVDB: 95657