Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2018-0495
Modified
More InfoOfficial Page
Source-security@debian.org
View Known Exploited Vulnerability (KEV) details
Published At-13 Jun, 2018 | 23:29
Updated At-07 Nov, 2023 | 02:51

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.04.7MEDIUM
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary2.01.9LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N
CPE Matches
gnupg
gnupg
>>libgcrypt>>Versions before 1.7.10(exclusive)
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*
gnupg
gnupg
>>libgcrypt>>Versions from 1.8.0(inclusive) to 1.8.3(exclusive)
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>14.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>16.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>17.10
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>ansible_tower>>3.3
cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_desktop>>7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_server>>7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_workstation>>7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Oracle Corporation
oracle
>>traffic_director>>11.1.1.9.0
cpe:2.3:a:oracle:traffic_director:11.1.1.9.0:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-203Primarynvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://www.securitytracker.com/id/1041144security@debian.org
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041147security@debian.org
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3221security@debian.org
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505security@debian.org
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1296security@debian.org
N/A
https://access.redhat.com/errata/RHSA-2019:1297security@debian.org
N/A
https://access.redhat.com/errata/RHSA-2019:1543security@debian.org
N/A
https://access.redhat.com/errata/RHSA-2019:2237security@debian.org
N/A
https://dev.gnupg.org/T4011security@debian.org
Patch
Vendor Advisory
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965security@debian.org
N/A
https://lists.debian.org/debian-lts-announce/2018/06/msg00013.htmlsecurity@debian.org
Mailing List
Third Party Advisory
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.htmlsecurity@debian.org
Vendor Advisory
https://usn.ubuntu.com/3689-1/security@debian.org
Third Party Advisory
https://usn.ubuntu.com/3689-2/security@debian.org
Third Party Advisory
https://usn.ubuntu.com/3692-1/security@debian.org
Third Party Advisory
https://usn.ubuntu.com/3692-2/security@debian.org
Third Party Advisory
https://usn.ubuntu.com/3850-1/security@debian.org
Third Party Advisory
https://usn.ubuntu.com/3850-2/security@debian.org
Third Party Advisory
https://www.debian.org/security/2018/dsa-4231security@debian.org
Third Party Advisory
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/security@debian.org
Exploit
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlsecurity@debian.org
Patch
Third Party Advisory
Change History
0Changes found
Details not found