Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 693108 (CVE-2019-13627) - <dev-libs/libgcrypt-1.8.5: ECDSA timing attack in the libgcrypt20 cryptographic library (CVE-2019-13627)
Summary: <dev-libs/libgcrypt-1.8.5: ECDSA timing attack in the libgcrypt20 cryptograp...
Alias: CVE-2019-13627
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: A4 [stable glsa+ cve]
Depends on:
Reported: 2019-08-30 08:52 UTC by Kristian Fiskerstrand
Modified: 2020-03-26 14:08 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---
stable-bot: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand gentoo-dev Security 2019-08-30 08:52:00 UTC

The GnuPG Project is pleased to announce the availability of Libgcrypt
version 1.8.5.  This release fixes an ECDSA side-channel attack.

Libgcrypt is a general purpose library of cryptographic building blocks.
It is originally based on code used by GnuPG.  It does not provide any
implementation of OpenPGP or other protocols.  Thorough understanding of
applied cryptography is required to use Libgcrypt.

Noteworthy changes in version 1.8.5

 * Bug fixes:

   - Add mitigation against an ECDSA timing attack.

   - Improve ECDSA unblinding.

 * Other features:

   - Provide a pkg-config file for libgcrypt.

Comment 1 Larry the Git Cow gentoo-dev 2019-08-30 09:00:07 UTC
The bug has been referenced in the following commit(s):

commit 7dcf27c125de973322f6b2199731e689837d714b
Author:     Kristian Fiskerstrand <>
AuthorDate: 2019-08-30 08:59:15 +0000
Commit:     Kristian Fiskerstrand <>
CommitDate: 2019-08-30 08:59:43 +0000

    dev-libs/libgcrypt: New upstream version 1.8.5
    Package-Manager: Portage-2.3.69, Repoman-2.3.16
    Signed-off-by: Kristian Fiskerstrand <>

 dev-libs/libgcrypt/Manifest               |  1 +
 dev-libs/libgcrypt/libgcrypt-1.8.5.ebuild | 76 +++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2019-10-13 08:28:09 UTC
Arches, please stabilize dev-libs/libgcrypt-1.8.5
Comment 3 Matt Turner gentoo-dev 2019-10-14 03:51:48 UTC
alpha stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-10-14 09:53:28 UTC
s390 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-10-14 11:08:38 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-10-14 11:16:54 UTC
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2019-10-14 11:25:38 UTC
ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-10-14 11:31:52 UTC
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2019-10-14 11:50:43 UTC
x86 stable
Comment 10 Rolf Eike Beer 2019-10-24 22:14:39 UTC
hppa stable
Comment 11 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-01 10:36:53 UTC
arm stable
Comment 12 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-11-06 23:15:17 UTC
arm64 stable
Comment 13 Agostino Sarubbo gentoo-dev 2019-11-13 13:17:23 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 14 Thomas Deutschmann gentoo-dev Security 2020-03-15 19:22:33 UTC
New GLSA request filed.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2020-03-15 19:33:02 UTC
This issue was resolved and addressed in
 GLSA 202003-32 at
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 16 Thomas Deutschmann gentoo-dev Security 2020-03-15 19:33:31 UTC
Re-opening for remaining architectures.
Comment 17 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-03-26 14:08:01 UTC
SuperH port disbanded.