CVE-2024-2236

2024-03-0600:00:00

ubuntu.com

libgcrypt

rsa

implementation

vulnerability

remote attackers

bleichenbacher-style attack

decryption

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

9.6%

JSON

A timing-based side-channel flaw was found in libgcrypt’s RSA
implementation. This issue may allow a remote attacker to initiate a
Bleichenbacher-style attack, which can lead to the decryption of RSA
ciphertexts.

Bugs

Notes

Author	Note
mdeslaur	No upstream fix for this issue as of 2024-07-18

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchlibgcrypt11< anyUNKNOWN
ubuntu18.04noarchlibgcrypt20< anyUNKNOWN
ubuntu20.04noarchlibgcrypt20< anyUNKNOWN
ubuntu22.04noarchlibgcrypt20< anyUNKNOWN
ubuntu24.04noarchlibgcrypt20< anyUNKNOWN
ubuntu16.04noarchlibgcrypt20< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	libgcrypt11	< any	UNKNOWN
ubuntu	18.04	noarch	libgcrypt20	< any	UNKNOWN
ubuntu	20.04	noarch	libgcrypt20	< any	UNKNOWN
ubuntu	22.04	noarch	libgcrypt20	< any	UNKNOWN
ubuntu	24.04	noarch	libgcrypt20	< any	UNKNOWN
ubuntu	16.04	noarch	libgcrypt20	< any	UNKNOWN