Lucene search
RedhatCVE-2013-4242HistoryAug 19, 2013 - 11:55 p.m.
CVE-2013-4242
2013-08-1923:55:09
CWE-200
redhat
web.nvd.nist.gov
83
gnupg
libgcrypt
vulnerability
rsa key
l3 cache
flush+reload
cve-2013-4242
nvd
CVSS2
1.9
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
AI Score
6
Confidence
Low
EPSS
0
Percentile
5.3%
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Affected configurations
Node
canonicalubuntu_linuxMatch10.04-lts
ORcanonicalubuntu_linuxMatch12.04-lts
ORcanonicalubuntu_linuxMatch12.10
ORcanonicalubuntu_linuxMatch13.04
Node
debiandebian_linuxMatch6.0
ORdebiandebian_linuxMatch7.0
Node
gnupggnupgRange≤1.4.13
ORgnupggnupgMatch0.0.0-
ORgnupggnupgMatch0.2.15
ORgnupggnupgMatch0.2.16
ORgnupggnupgMatch0.2.17
ORgnupggnupgMatch0.2.18
ORgnupggnupgMatch0.2.19
ORgnupggnupgMatch0.3.0
ORgnupggnupgMatch0.3.1
ORgnupggnupgMatch0.3.2
ORgnupggnupgMatch0.3.3
ORgnupggnupgMatch0.3.4
ORgnupggnupgMatch0.3.5
ORgnupggnupgMatch0.4.0
ORgnupggnupgMatch0.4.1
ORgnupggnupgMatch0.4.3
ORgnupggnupgMatch0.4.4
ORgnupggnupgMatch0.4.5
ORgnupggnupgMatch0.9.0
ORgnupggnupgMatch0.9.1
ORgnupggnupgMatch0.9.2
ORgnupggnupgMatch0.9.3
ORgnupggnupgMatch0.9.4
ORgnupggnupgMatch0.9.5
ORgnupggnupgMatch0.9.6
ORgnupggnupgMatch0.9.7
ORgnupggnupgMatch0.9.8
ORgnupggnupgMatch0.9.9
ORgnupggnupgMatch0.9.10
ORgnupggnupgMatch0.9.11
ORgnupggnupgMatch1.0.0
ORgnupggnupgMatch1.0.1
ORgnupggnupgMatch1.0.2
ORgnupggnupgMatch1.0.3
ORgnupggnupgMatch1.0.4
ORgnupggnupgMatch1.0.4-win32
ORgnupggnupgMatch1.0.5
ORgnupggnupgMatch1.0.5-win32
ORgnupggnupgMatch1.0.6
ORgnupggnupgMatch1.0.7
ORgnupggnupgMatch1.2.0
ORgnupggnupgMatch1.2.1
ORgnupggnupgMatch1.2.1windows
ORgnupggnupgMatch1.2.2
ORgnupggnupgMatch1.2.3
ORgnupggnupgMatch1.2.4
ORgnupggnupgMatch1.2.5
ORgnupggnupgMatch1.2.6
ORgnupggnupgMatch1.2.7
ORgnupggnupgMatch1.3.0
ORgnupggnupgMatch1.3.1
ORgnupggnupgMatch1.3.2
ORgnupggnupgMatch1.3.3
ORgnupggnupgMatch1.3.4
ORgnupggnupgMatch1.3.6
ORgnupggnupgMatch1.3.90
ORgnupggnupgMatch1.3.91
ORgnupggnupgMatch1.3.92
ORgnupggnupgMatch1.3.93
ORgnupggnupgMatch1.4.0
ORgnupggnupgMatch1.4.10
ORgnupggnupgMatch1.4.11
ORgnupggnupgMatch1.4.12
Node
gnupggnupgMatch2.0.1
ORgnupggnupgMatch2.0.3
ORgnupggnupgMatch2.0.4
ORgnupggnupgMatch2.0.5
ORgnupggnupgMatch2.0.6
ORgnupggnupgMatch2.0.7
ORgnupggnupgMatch2.0.8
ORgnupggnupgMatch2.0.10
ORgnupggnupgMatch2.0.11
ORgnupggnupgMatch2.0.12
ORgnupggnupgMatch2.0.13
ORgnupggnupgMatch2.0.14
ORgnupggnupgMatch2.0.15
ORgnupggnupgMatch2.0.16
ORgnupggnupgMatch2.0.17
ORgnupggnupgMatch2.0.18
ORgnupggnupgMatch2.0.19
Node
gnupglibgcryptRange≤1.5.2
ORgnupglibgcryptMatch1.4.0
ORgnupglibgcryptMatch1.4.3
ORgnupglibgcryptMatch1.4.4
ORgnupglibgcryptMatch1.4.5
ORgnupglibgcryptMatch1.4.6
ORgnupglibgcryptMatch1.5.0
ORgnupglibgcryptMatch1.5.1
Node
opensuseopensuseMatch12.2
ORopensuseopensuseMatch12.3
| Vendor | Product | Version | CPE |
|---|---|---|---|
| canonical | ubuntu_linux | 10.04 | cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:* |
| canonical | ubuntu_linux | 12.04 | cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* |
| canonical | ubuntu_linux | 12.10 | cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 13.04 | cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* |
| debian | debian_linux | 6.0 | cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| gnupg | gnupg | * | cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:* |
| gnupg | gnupg | 0.0.0 | cpe:2.3:a:gnupg:gnupg:0.0.0:-:*:*:*:*:*:* |
| gnupg | gnupg | 0.2.15 | cpe:2.3:a:gnupg:gnupg:0.2.15:*:*:*:*:*:*:* |
| gnupg | gnupg | 0.2.16 | cpe:2.3:a:gnupg:gnupg:0.2.16:*:*:*:*:*:*:* |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880
eprint.iacr.org/2013/448
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html
lists.opensuse.org/opensuse-updates/2013-08/msg00003.html
rhn.redhat.com/errata/RHSA-2013-1457.html
secunia.com/advisories/54318
secunia.com/advisories/54321
secunia.com/advisories/54332
secunia.com/advisories/54375
www.debian.org/security/2013/dsa-2730
www.debian.org/security/2013/dsa-2731
www.kb.cert.org/vuls/id/976534
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
www.securityfocus.com/bid/61464
www.ubuntu.com/usn/USN-1923-1
Related
openvas
openvas
Oracle: Security Advisory (ELSA-2013-1457)
2015-10-06 00:00:00
Fedora Update for gnupg FEDORA-2013-13940
2013-08-16 00:00:00
Amazon Linux: Security Advisory (ALAS-2013-225)
2015-09-08 00:00:00
freebsd
freebsd
GnuPG and Libgcrypt -- side-channel attack vulnerability
2013-07-18 00:00:00
nessus
nessus
amazon
amazon
Medium: gnupg
2013-09-19 15:29:00
Medium: libgcrypt
2013-09-19 15:49:00
oraclelinux
oraclelinux
libgcrypt security update
2013-10-24 00:00:00
gnupg security update
2013-10-24 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: libgcrypt-1.5.3-1.fc19
2013-08-02 03:22:41
[SECURITY] Fedora 18 Update: gnupg-1.4.14-1.fc18
2013-08-15 02:56:52
[SECURITY] Fedora 18 Update: libgcrypt-1.5.3-1.fc18
2013-08-02 03:21:32
redhat
redhat
(RHSA-2013:1457) Moderate: libgcrypt security update
2013-10-24 00:00:00
(RHSA-2013:1458) Moderate: gnupg security update
2013-10-24 00:00:00
(RHSA-2013:1527) Important: rhev-hypervisor6 security and bug fix update
2013-11-21 00:00:00
ubuntu
ubuntu
GnuPG, Libgcrypt vulnerability
2013-08-01 00:00:00
debian
debian
[SECURITY] [DSA 2731-1] libgcrypt11 security update
2013-07-29 18:50:25
[SECURITY] [DSA 2730-1] gnupg security update
2013-07-29 18:49:06
securityvulns
securityvulns
gnupg / libcrypt RSA implementation flush+reload timing attack
2013-08-12 00:00:00
[slackware-security] gnupg / libgcrypt (SSA:2013-215-01)
2013-08-12 00:00:00
ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities
2015-02-02 00:00:00
mageia
mageia
Updated gnupg package fixes security vulnerability
2013-08-03 12:45:05
nvd
nvd
CVE-2013-4242
2013-08-19 23:55:09
veracode
veracode
Information Disclosure
2019-01-15 09:01:17
Information Disclosure
2019-05-02 04:56:46
Denial Of Service (DOS)
2019-05-02 04:56:46
centos
centos
libgcrypt security update
2013-10-24 16:06:22
gnupg security update
2013-10-25 14:00:34
slackware
slackware
[slackware-security] gnupg / libgcrypt
2013-08-03 22:26:17
altlinux
altlinux
Security fix for the ALT Linux 7 package gnupg version 1.4.14-alt1
2013-07-25 00:00:00
f5
f5
K75253136 : GnuPG vulnerability CVE-2013-4242
2016-02-19 00:00:00
SOL75253136 - GnuPG vulnerability CVE-2013-4242
2016-02-19 00:00:00
ubuntucve
ubuntucve
CVE-2013-4242
2013-07-29 00:00:00
prion
prion
Design/Logic Flaw
2013-08-19 23:55:00
cert
cert
cvelist
cvelist
CVE-2013-4242
2013-08-19 23:00:00
gentoo
gentoo
GnuPG, Libgcrypt: Multiple vulnerabilities
2014-02-21 00:00:00
osv
osv
libgcrypt-cavs-1.7.3-1.3 on GA media
2024-06-15 00:00:00
CVSS2
1.9
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
AI Score
6
Confidence
Low
EPSS
0
Percentile
5.3%
Related for CVE-2013-4242