CVE-2014-3591

State: Published
Severity: Not scored
Published: Nov 29, 2019
Updated: Aug 6, 2024
Reserved: May 14, 2014

Description

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LibgcryptGNU	before 1.6.3Affected
GnuPGGNU	before 1.4.19Affected

References

http://www.cs.tau.ac.il/~tromer/radioexp/
https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html
https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html
http://www.debian.org/security/2015/dsa-3184
http://www.debian.org/security/2015/dsa-3185

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.