Description: "Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. (There is also an interoperability problem because the selection of the k integer value does not properly consider the differences between basic ElGamal encryption and generalized ElGamal encryption.) This, for example, affects use of ElGamal in OpenPGP."
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ebb8899e39bc7a7773fe930e68697cc48aab8d3 commit 5ebb8899e39bc7a7773fe930e68697cc48aab8d3 Author: Sam James <sam@gentoo.org> AuthorDate: 2021-06-16 16:38:43 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-06-16 16:42:04 +0000 dev-libs/libgcrypt: add 1.8.8 Bug: https://bugs.gentoo.org/795480 Signed-off-by: Sam James <sam@gentoo.org> dev-libs/libgcrypt/Manifest | 1 + dev-libs/libgcrypt/libgcrypt-1.8.8.ebuild | 84 +++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+)
*** Bug 767814 has been marked as a duplicate of this bug. ***
arm done
arm64 done
sparc done
ppc64 stable
amd64 stable
x86 stable
ppc done
hppa done
Please cleanup.
GLSA request filed
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=65e8a66a03a13ff76fb2733745a316822ef89c7e commit 65e8a66a03a13ff76fb2733745a316822ef89c7e Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-10-31 01:09:53 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-10-31 01:40:14 +0000 [ GLSA 202210-13 ] libgcrypt: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/766213 Bug: https://bugs.gentoo.org/795480 Bug: https://bugs.gentoo.org/811900 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202210-13.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+)
GLSA released, all done!
