Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 693108 (CVE-2019-13627) - <dev-libs/libgcrypt-1.8.5: ECDSA side-channel attack
Summary: <dev-libs/libgcrypt-1.8.5: ECDSA side-channel attack
Status: IN_PROGRESS
Alias: CVE-2019-13627
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A4 [stable]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-30 08:52 UTC by Kristian Fiskerstrand
Modified: 2019-11-06 23:15 UTC (History)
5 users (show)

See Also:
Package list:
dev-libs/libgcrypt-1.8.5
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand gentoo-dev Security 2019-08-30 08:52:00 UTC
Hi!

The GnuPG Project is pleased to announce the availability of Libgcrypt
version 1.8.5.  This release fixes an ECDSA side-channel attack.

Libgcrypt is a general purpose library of cryptographic building blocks.
It is originally based on code used by GnuPG.  It does not provide any
implementation of OpenPGP or other protocols.  Thorough understanding of
applied cryptography is required to use Libgcrypt.


Noteworthy changes in version 1.8.5
===================================

 * Bug fixes:

   - Add mitigation against an ECDSA timing attack.
     [T4626,CVE-2019-13627]

   - Improve ECDSA unblinding.

 * Other features:

   - Provide a pkg-config file for libgcrypt.

 Release-info: https://dev.gnupg.org/T4683
Comment 1 Larry the Git Cow gentoo-dev 2019-08-30 09:00:07 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7dcf27c125de973322f6b2199731e689837d714b

commit 7dcf27c125de973322f6b2199731e689837d714b
Author:     Kristian Fiskerstrand <k_f@gentoo.org>
AuthorDate: 2019-08-30 08:59:15 +0000
Commit:     Kristian Fiskerstrand <k_f@gentoo.org>
CommitDate: 2019-08-30 08:59:43 +0000

    dev-libs/libgcrypt: New upstream version 1.8.5
    
    Bug: https://bugs.gentoo.org/693108
    Package-Manager: Portage-2.3.69, Repoman-2.3.16
    Signed-off-by: Kristian Fiskerstrand <k_f@gentoo.org>

 dev-libs/libgcrypt/Manifest               |  1 +
 dev-libs/libgcrypt/libgcrypt-1.8.5.ebuild | 76 +++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2019-10-13 08:28:09 UTC
Arches, please stabilize dev-libs/libgcrypt-1.8.5
Comment 3 Matt Turner gentoo-dev 2019-10-14 03:51:48 UTC
alpha stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-10-14 09:53:28 UTC
s390 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-10-14 11:08:38 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-10-14 11:16:54 UTC
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2019-10-14 11:25:38 UTC
ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-10-14 11:31:52 UTC
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2019-10-14 11:50:43 UTC
x86 stable
Comment 10 Rolf Eike Beer 2019-10-24 22:14:39 UTC
hppa stable
Comment 11 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-01 10:36:53 UTC
arm stable
Comment 12 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-11-06 23:15:17 UTC
arm64 stable