openSUSE Security Update : libgcrypt (openSUSE-SU-2013:1294-1)

medium Nessus Plugin ID 75105

Synopsis

The remote openSUSE host is missing a security update.

Description

libgcrypt was updated to 1.5.3 [bnc#831359] to fix a security issue, bugs and get some new features :

Security issue fixed :

- Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. See <http://eprint.iacr.org/2013/448>.

- contains changes from 1.5.2

- The upstream sources now contain the IDEA algorithm, dropping: idea.c.gz libgcrypt-1.5.0-idea.patch libgcrypt-1.5.0-idea_codecleanup.patch

- Made the Padlock code work again (regression since 1.5.0).

- Fixed alignment problems for Serpent.

- Fixed two bugs in ECC computations.

- add GPL3.0+ to License tag because of dumpsexp (bnc#810759)

- contains changes from 1.5.1

- Allow empty passphrase with PBKDF2.

- Do not abort on an invalid algorithm number in gcry_cipher_get_algo_keylen and gcry_cipher_get_algo_blklen.

- Fixed some Valgrind warnings.

- Fixed a problem with select and high fd numbers.

- Improved the build system

- Various minor bug fixes.

- Interface changes relative to the 1.5.0 release:
GCRYCTL_SET_ENFORCED_FIPS_FLAG NEW.
GCRYPT_VERSION_NUMBER NEW.

Solution

Update the affected libgcrypt packages.

See Also

https://eprint.iacr.org/2013/448

https://bugzilla.novell.com/show_bug.cgi?id=810759

https://bugzilla.novell.com/show_bug.cgi?id=831359

https://lists.opensuse.org/opensuse-updates/2013-08/msg00003.html

Plugin Details

Severity: Medium

ID: 75105

File Name: openSUSE-2013-627.nasl

Version: 1.9

Type: local

Agent: unix

Published: 6/13/2014

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libgcrypt-debugsource, p-cpe:/a:novell:opensuse:libgcrypt-devel, p-cpe:/a:novell:opensuse:libgcrypt-devel-32bit, p-cpe:/a:novell:opensuse:libgcrypt-devel-debuginfo, p-cpe:/a:novell:opensuse:libgcrypt-devel-debuginfo-32bit, p-cpe:/a:novell:opensuse:libgcrypt11, p-cpe:/a:novell:opensuse:libgcrypt11-32bit, p-cpe:/a:novell:opensuse:libgcrypt11-debuginfo, p-cpe:/a:novell:opensuse:libgcrypt11-debuginfo-32bit, cpe:/o:novell:opensuse:12.2, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 7/26/2013