[gentoo-announce] [ GLSA 201610-04 ] libgcrypt: Multiple vulnerabilities - gentoo-announce

From:	Kristian Fiskerstrand <k_f@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201610-04 ] libgcrypt: Multiple vulnerabilities
Date:	Mon, 10 Oct 2016 11:07:19
Message-Id:	`24ca6848-042e-f900-eee1-253851823d15@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201610-04

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: libgcrypt: Multiple vulnerabilities

9

     Date: October 10, 2016

10

     Bugs: #541564, #559942, #574268, #591534

11

       ID: 201610-04

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been fixed in libgcrypt,the worst of

19

which results in predictable output from the random number generator.

20

21

Background

22

==========

23

24

libgcrypt is a general purpose cryptographic library derived out of

25

GnuPG.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  dev-libs/libgcrypt           < 1.7.3                    >= 1.7.3

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in libgcrypt. Please

39

review the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

Side-channel attacks can leak private key information. A separate

45

critical bug allows an attacker who obtains 4640 bits from the RNG to

46

trivially predict the next 160 bits of output.

47

48

Workaround

49

==========

50

51

There is no known workaround at this time.

52

53

Resolution

54

==========

55

56

All libgcrypt users should upgrade to the latest version:

57

58

  # emerge --sync

59

  # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.7.3"

60

61

References

62

==========

63

64

[ 1 ] CVE-2014-3591

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3591

66

[ 2 ] CVE-2015-0837

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0837

68

[ 3 ] CVE-2015-7511

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7511

70

[ 4 ] CVE-2016-6313

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6313

72

[ 5 ] Factoring RSA Keys With TLS Perfect Forward Secrecy

73

74

https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/

75

76

Availability

77

============

78

79

This GLSA and any updates to it are available for viewing at

80

the Gentoo Security Website:

81

82

 https://security.gentoo.org/glsa/201610-04

83

84

Concerns?

85

=========

86

87

Security is a primary focus of Gentoo Linux and ensuring the

88

confidentiality and security of our users' machines is of utmost

89

importance to us. Any security concerns should be addressed to

90

security@g.o or alternatively, you may file a bug at

91

https://bugs.gentoo.org.

92

93

License

94

=======

95

96

Copyright 2016 Gentoo Foundation, Inc; referenced text

97

belongs to its owner(s).

98

99

The contents of this document are licensed under the

100

Creative Commons - Attribution / Share Alike license.

101

102

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201610-04
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: libgcrypt: Multiple vulnerabilities
9	Date: October 10, 2016
10	Bugs: #541564, #559942, #574268, #591534
11	ID: 201610-04
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been fixed in libgcrypt,the worst of
19	which results in predictable output from the random number generator.
20
21	Background
22	==========
23
24	libgcrypt is a general purpose cryptographic library derived out of
25	GnuPG.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 dev-libs/libgcrypt < 1.7.3 >= 1.7.3
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in libgcrypt. Please
39	review the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	Side-channel attacks can leak private key information. A separate
45	critical bug allows an attacker who obtains 4640 bits from the RNG to
46	trivially predict the next 160 bits of output.
47
48	Workaround
49	==========
50
51	There is no known workaround at this time.
52
53	Resolution
54	==========
55
56	All libgcrypt users should upgrade to the latest version:
57
58	# emerge --sync
59	# emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.7.3"
60
61	References
62	==========
63
64	[ 1 ] CVE-2014-3591
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3591
66	[ 2 ] CVE-2015-0837
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0837
68	[ 3 ] CVE-2015-7511
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7511
70	[ 4 ] CVE-2016-6313
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6313
72	[ 5 ] Factoring RSA Keys With TLS Perfect Forward Secrecy
73
74	https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
75
76	Availability
77	============
78
79	This GLSA and any updates to it are available for viewing at
80	the Gentoo Security Website:
81
82	https://security.gentoo.org/glsa/201610-04
83
84	Concerns?
85	=========
86
87	Security is a primary focus of Gentoo Linux and ensuring the
88	confidentiality and security of our users' machines is of utmost
89	importance to us. Any security concerns should be addressed to
90	security@g.o or alternatively, you may file a bug at
91	https://bugs.gentoo.org.
92
93	License
94	=======
95
96	Copyright 2016 Gentoo Foundation, Inc; referenced text
97	belongs to its owner(s).
98
99	The contents of this document are licensed under the
100	Creative Commons - Attribution / Share Alike license.
101
102	http://creativecommons.org/licenses/by-sa/2.5