This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-33560 →
DEBIAN-CVE-2021-33560
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack agains...
Original description
The description as published by the source.
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2"}]}]
Debian:13
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2"}]}]
Debian:14
libgcrypt20
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2"}]}]
References
- advisory security-tracker.debian.org