It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.

For Debian 8 'Jessie', these problems have been fixed in version 1.6.3-2+deb8u5.

We recommend that you upgrade your libgcrypt20 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issue :

The following security issue was fixed :

  - CVE-2018-0495: Fixed a novel side-channel attack, by     enabling blinding for ECDSA signatures (bsc#1097410)

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has nss packages installed that are affected by multiple vulnerabilities:

  - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a     memory-cache side-channel attack on ECDSA signatures     that can be mitigated through the use of blinding during     the signing process in the _gcry_ecc_ecdsa_sign function     in cipher/ecc-ecdsa.c, aka the Return Of the Hidden     Number Problem or ROHNP. To discover an ECDSA key, the     attacker needs access to either the local machine or a     different virtual machine on the same physical host.
    (CVE-2018-0495)

  - A cached side channel attack during handshakes using RSA     encryption could allow for the decryption of encrypted     content. This is a variant of the Adaptive Chosen     Ciphertext attack (AKA Bleichenbacher attack) and     affects all NSS versions prior to NSS 3.41.
    (CVE-2018-12404)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3221 advisory.

    - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
    - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
    - fix CVE-2018-0732 - large prime DH DoS of TLS client
    - fix CVE-2018-0737 - RSA key generation cache timing vulnerability

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libgcrypt fixes the following issue: The following security issue was fixed :

  - CVE-2018-0495: Fixed a novel side-channel attack, by     enabling blinding for ECDSA signatures (bsc#1097410)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Minor update to version 1.1.1a with bug fixes and low impact security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1267 advisory.

    The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

    Security Fix(es):

    * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate     (CVE-2019-11745)

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1461 advisory.

    The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

    Security Fix(es):

    * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate     (CVE-2019-11745)

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
110814	Debian DLA-1405-1 : libgcrypt20 security update	Nessus	Debian Local Security Checks	7/2/2018	3/27/2025	medium
111421	openSUSE Security Update : libgcrypt (openSUSE-2018-769)	Nessus	SuSE Local Security Checks	7/30/2018	3/26/2025	medium
132493	NewStart CGSL CORE 5.05 / MAIN 5.05 : nss Multiple Vulnerabilities (NS-SA-2019-0236)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	2/21/2025	medium
118777	Oracle Linux 7 : openssl (ELSA-2018-3221)	Nessus	Oracle Linux Local Security Checks	11/7/2018	3/24/2025	medium
123229	openSUSE Security Update : libgcrypt (openSUSE-2019-540)	Nessus	SuSE Local Security Checks	3/27/2019	3/13/2025	medium
120054	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2018:1993-1)	Nessus	SuSE Local Security Checks	1/2/2019	3/21/2025	medium
121239	Fedora 29 : 1:openssl (2019-a8ffcff7ee)	Nessus	Fedora Local Security Checks	1/18/2019	6/26/2024	medium
135092	RHEL 7 : nss-softokn (RHSA-2020:1267)	Nessus	Red Hat Local Security Checks	4/1/2020	11/8/2024	high
135460	RHEL 7 : nss-softokn (RHSA-2020:1461)	Nessus	Red Hat Local Security Checks	4/14/2020	11/7/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

high

high