Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2017-9526 →
DEBIAN-CVE-2017-9526
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-2"}]}]
Debian:13
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-2"}]}]
Debian:14
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-2"}]}]
Références
- advisory security-tracker.debian.org