Updated gnupg package fixes security vulnerability

2013-08-0312:45:05

Gentoo Foundation

advisories.mageia.org

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS

Percentile

5.3%

JSON

Yarom and Falkner discovered that RSA secret keys in applications using GnuPG 1.x, and using the libgcrypt library, could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system (CVE-2013-4242).

OSVersionArchitecturePackageVersionFilename
Mageia2noarchgnupg< 1.4.12-1.2gnupg-1.4.12-1.2.mga2
Mageia2noarchlibgcrypt< 1.5.0-2.1libgcrypt-1.5.0-2.1.mga2
Mageia3noarchgnupg< 1.4.14-1gnupg-1.4.14-1.mga3
Mageia3noarchlibgcrypt< 1.5.3-1libgcrypt-1.5.3-1.mga3

OS	Version	Architecture	Package	Version	Filename
Mageia	2	noarch	gnupg	< 1.4.12-1.2	gnupg-1.4.12-1.2.mga2
Mageia	2	noarch	libgcrypt	< 1.5.0-2.1	libgcrypt-1.5.0-2.1.mga2
Mageia	3	noarch	gnupg	< 1.4.14-1	gnupg-1.4.14-1.mga3
Mageia	3	noarch	libgcrypt	< 1.5.3-1	libgcrypt-1.5.3-1.mga3