CVE catalog

CVE-2013-4242

libgcrypt-cavs-1.7.3-1.3 on GA media

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.53% · Oct 25, 2026

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. GnuPG susceptible to Yarom/Falkner flush+reload cache side-channel attack This issue affects the version of gnupg as shipped with Red Hat Enterprise Linux 5. This issue affects the version of libgcrypt as shipped with Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update may address this flaw. More technical details on this flaw are available at https://bugzilla.redhat.com/show_bug.cgi?id=988589#c12 The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibgcrypt116.01.4.5-2vulnerable
Debianlibgcrypt116.01.4.5-2+squeeze1fixed
Debianlibgcrypt1171.5.0-5vulnerable
Debianlibgcrypt1171.5.0-5+deb7u1fixed
Debiangnupg6.01.4.10-4vulnerable
Debiangnupg6.01.4.10-4+squeeze1vulnerable
Debiangnupg6.01.4.10-4+squeeze2fixed
Debiangnupg71.4.12-7vulnerable
Debiangnupg71.4.12-7+deb7u1fixed
Opensuselibgcrypttumbleweed1.7.3-1.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibgcrypt11deb6.01.4.5-2+squeeze1Not reportedDSA-2731-1Not reported
Debianlibgcrypt11deb71.5.0-5+deb7u1Not reportedDSA-2731-1Not reported
Debiangnupgdeb6.01.4.10-4+squeeze2Not reportedDSA-2730-1Not reported
Debiangnupgdeb71.4.12-7+deb7u1Not reportedDSA-2730-1Not reported
Opensuselibgcryptrpmtumbleweed1.7.3-1.3Not reportedOPENSUSE-SU-2024:10037-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libgcrypt20]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

  • [libgcrypt20-32bit]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

  • [libgcrypt20-x86-64-v3]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

  • [libgcrypt-devel]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

  • [libgcrypt-devel-32bit]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

  • [libgcrypt-devel-x86-64-v3]Unknown

    Source package: [libgcrypt]

    Details (1)

    • 1.12.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.3-1.3

      Version impact unknown

      pypi · libgcrypt · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]