The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before …
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
References
- http://www.debian.org/security/2015/dsa-3184 x_refsource_MISC
- http://www.debian.org/security/2015/dsa-3185 x_refsource_MISC
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html x_refsource_CONFIRM
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html x_refsource_CONFIRM
- https://ieeexplore.ieee.org/document/7163050 x_refsource_MISC
- http://www.debian.org/security/2015/dsa-3184 x_refsource_MISC x_transferred
- http://www.debian.org/security/2015/dsa-3185 x_refsource_MISC x_transferred
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html x_refsource_CONFIRM x_transferred
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html x_refsource_CONFIRM x_transferred
- https://ieeexplore.ieee.org/document/7163050 x_refsource_MISC x_transferred
- http://www.debian.org/security/2015/dsa-3185 x_refsource_MISC
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html x_refsource_CONFIRM
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html x_refsource_CONFIRM
- https://ieeexplore.ieee.org/document/7163050 x_refsource_MISC
- http://www.debian.org/security/2015/dsa-3184 x_refsource_MISC
- http://www.debian.org/security/2015/dsa-3184 x_refsource_MISC x_transferred
- http://www.debian.org/security/2015/dsa-3185 x_refsource_MISC x_transferred
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html x_refsource_CONFIRM x_transferred
- https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html x_refsource_CONFIRM x_transferred
- https://ieeexplore.ieee.org/document/7163050 x_refsource_MISC x_transferred
Affected products
- ==before 1.4.19
- ==before 1.6.3
Matching in nixpkgs
pkgs.gnupg
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation
pkgs.gnupg1
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation with symbolic links for gpg and gpgv
pkgs.gnupg24
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation
pkgs.libgcrypt
General-purpose cryptographic library
pkgs.pam_gnupg
Unlock GnuPG keys on login
pkgs.gnupg1compat
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation with symbolic links for gpg and gpgv
pkgs.gnupg-pkcs11-scd
Smart-card daemon to enable the use of PKCS#11 tokens with GnuPG
-
nixos-unstable pkcs11-scd-0.11.0
- nixpkgs-unstable pkcs11-scd-0.11.0
- nixos-unstable-small pkcs11-scd-0.11.0
-
nixos-25.11 pkcs11-scd-0.11.0
- nixos-25.11-small pkcs11-scd-0.11.0
- nixpkgs-25.11-darwin pkcs11-scd-0.11.0
pkgs.phpExtensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php81Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php82Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php83Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php84Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php85Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.sequoia-chameleon-gnupg
Sequoia's reimplementation of the GnuPG interface
pkgs.perlPackages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.perl5Packages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.perl538Packages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.perl540Packages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.python312Packages.python-gnupg
API for the GNU Privacy Guard (GnuPG)
pkgs.python313Packages.python-gnupg
API for the GNU Privacy Guard (GnuPG)
pkgs.python314Packages.python-gnupg
API for the GNU Privacy Guard (GnuPG)
Package maintainers
-
@stigtsp Stig Palmquist <stig@stig.io>
-
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@philandstuff Philip Potter <philip.g.potter@gmail.com>
-
@mtreca Maxime Tréca <maxime.treca@gmail.com>
-
@aanderse Aaron Andersen <aaron@fosslib.net>
-
@piotrkwiecinski Piotr Kwiecinski <piokwiecinski+nixpkgs@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
-
@NickCao Nick Cao <nickcao@nichi.co>