CVE catalog

CVE-2017-7526

gnupg2: CVE-2017-7526

Severity: Medium · CVSS 6.1CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Published: Jun 29, 2017, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 3.84% · Oct 25, 2026

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gnupg1	sid	`1.4.23-3`	fixed
Debian	gnupg1	forky	`1.4.23-3`	fixed
Debian	gnupg1	trixie	`1.4.23-3`	fixed
Debian	gnupg1	bookworm	`1.4.23-1.1`	fixed
Debian	gnupg2	sid	`2.4.9-8`	not affected
Debian	gnupg2	forky	`2.4.9-8`	not affected
Debian	gnupg2	trixie	`2.4.7-21+deb13u1`	not affected
Debian	gnupg2	bookworm	`2.2.40-1.1+deb12u2`	not affected
Debian	libgcrypt20	sid	`1.12.4-2`	fixed
Debian	libgcrypt20	forky	`1.12.4-2`	fixed
Debian	libgcrypt20	trixie	`1.11.0-7+deb13u1`	fixed
Debian	libgcrypt20	trixie-security	`1.11.0-7+deb13u1`	fixed
Debian	libgcrypt20	bookworm	`1.10.1-3+deb12u1`	fixed
Debian	libgcrypt20	bookworm-security	`1.10.1-3+deb12u1`	fixed
Alpine	gnupg1	3.10	`1.4.23-r0`	fixed
Alpine	gnupg1	3.11	`1.4.23-r0`	fixed
Alpine	gnupg1	3.12	`1.4.23-r0`	fixed
Alpine	gnupg1	3.5	`1.4.23-r0`	fixed
Alpine	gnupg1	3.6	`1.4.23-r0`	fixed
Alpine	gnupg1	3.7	`1.4.23-r0`	fixed
Alpine	gnupg1	3.8	`1.4.23-r0`	fixed
Alpine	gnupg1	3.9	`1.4.23-r0`	fixed
Ubuntu	gnupg	14.04	`1.4.14-1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-1.1ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-1.1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-2ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.3`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.4`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.5`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.6`	fixed
Ubuntu	libgcrypt11	14.04	`1.5.0-3ubuntu3`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu1`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.1`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.2`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.3`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.4`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.5`	fixed
Ubuntu	gnupg	16.04	`1.4.18-7ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.19-6ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu2`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.2`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.3`	fixed
Ubuntu	libgcrypt20	16.04	`1.6.3-2ubuntu1`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-3`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-4`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-5`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2ubuntu0.2`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2ubuntu0.3`	fixed
Ubuntu	libgcrypt11	14.04	`1.5.0-3ubuntu3`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu1`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.1`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.2`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.3`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.4`	vulnerable
Ubuntu	libgcrypt11	14.04	`1.5.3-2ubuntu4.5`	fixed
Ubuntu	libgcrypt20	16.04	`1.6.3-2ubuntu1`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-3`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-4`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.4-5`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2ubuntu0.2`	vulnerable
Ubuntu	libgcrypt20	16.04	`1.6.5-2ubuntu0.3`	fixed
Ubuntu	gnupg	14.04	`1.4.14-1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-1.1ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-1.1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.15-2ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.1`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.3`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.4`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.5`	vulnerable
Ubuntu	gnupg	14.04	`1.4.16-1ubuntu2.6`	fixed
Ubuntu	gnupg	16.04	`1.4.18-7ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.19-6ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu2`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.1`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.2`	vulnerable
Ubuntu	gnupg	16.04	`1.4.20-1ubuntu3.3`	fixed
Suse	libgcrypt	linux enterprise desktop 12 sp2	`1.6.1-16.42.1`	fixed
Suse	libgcrypt	linux enterprise server for raspberry pi 12 sp2	`1.6.1-16.42.1`	fixed
Suse	libgcrypt	linux enterprise software development kit 12 sp2	`1.6.1-16.42.1`	fixed
Suse	libgcrypt	linux enterprise server 12 sp2	`1.6.1-16.42.1`	fixed
Suse	libgcrypt	linux enterprise server for sap applications 12 sp2	`1.6.1-16.42.1`	fixed
Suse	compat-libgcrypt11	linux enterprise module for legacy 12	`1.5.0-0.6.1`	fixed
Suse	libgcrypt	linux enterprise software development kit 11 sp4	`1.5.0-0.25.1`	fixed
Suse	libgcrypt	linux enterprise server 11 sp4	`1.5.0-0.25.1`	fixed
Suse	libgcrypt	linux enterprise server for sap applications 11 sp4	`1.5.0-0.25.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gnupg1	source	sid	`1.4.22-1`	not yet assigned	Not reported	Not reported
Debian	gnupg1	source	forky	`1.4.22-1`	not yet assigned	Not reported	Not reported
Debian	gnupg1	source	trixie	`1.4.22-1`	not yet assigned	Not reported	Not reported
Debian	gnupg1	source	bookworm	`1.4.22-1`	not yet assigned	Not reported	Not reported
Debian	gnupg2	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	gnupg2	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	gnupg2	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	gnupg2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Debian	libgcrypt20	source	sid	`1.7.8-1`	not yet assigned	Not reported	Not reported
Debian	libgcrypt20	source	forky	`1.7.8-1`	not yet assigned	Not reported	Not reported
Debian	libgcrypt20	source	trixie	`1.7.8-1`	not yet assigned	Not reported	Not reported
Debian	libgcrypt20	source	bookworm	`1.7.8-1`	not yet assigned	Not reported	Not reported
Alpine	gnupg1	apk	3.10	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.11	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.12	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.5	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.6	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.7	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.8	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Alpine	gnupg1	apk	3.9	`1.4.23-r0`	Not reported	ALPINE-CVE-2017-7526	Not reported
Ubuntu	gnupg	deb	14.04	`1.4.16-1ubuntu2.6`	Not reported	UBUNTU-CVE-2017-7526	Not reported
Ubuntu	libgcrypt11	deb	14.04	`1.5.3-2ubuntu4.5`	Not reported	UBUNTU-CVE-2017-7526	Not reported
Ubuntu	gnupg	deb	16.04	`1.4.20-1ubuntu3.3`	Not reported	UBUNTU-CVE-2017-7526	Not reported
Ubuntu	libgcrypt20	deb	16.04	`1.6.5-2ubuntu0.3`	Not reported	UBUNTU-CVE-2017-7526	Not reported
Ubuntu	libgcrypt11	deb	14.04	`1.5.3-2ubuntu4.5`	Not reported	USN-3347-1	Not reported
Ubuntu	libgcrypt20	deb	16.04	`1.6.5-2ubuntu0.3`	Not reported	USN-3347-1	Not reported
Ubuntu	gnupg	deb	14.04	`1.4.16-1ubuntu2.6`	Not reported	USN-3733-1	Not reported
Ubuntu	gnupg	deb	16.04	`1.4.20-1ubuntu3.3`	Not reported	USN-3733-1	Not reported
Suse	libgcrypt	rpm	linux enterprise desktop 12 sp2	`1.6.1-16.42.1`	Not reported	SUSE-SU-2017:1794-1	Not reported
Suse	libgcrypt	rpm	linux enterprise server for raspberry pi 12 sp2	`1.6.1-16.42.1`	Not reported	SUSE-SU-2017:1794-1	Not reported
Suse	libgcrypt	rpm	linux enterprise software development kit 12 sp2	`1.6.1-16.42.1`	Not reported	SUSE-SU-2017:1794-1	Not reported
Suse	libgcrypt	rpm	linux enterprise server 12 sp2	`1.6.1-16.42.1`	Not reported	SUSE-SU-2017:1794-1	Not reported
Suse	libgcrypt	rpm	linux enterprise server for sap applications 12 sp2	`1.6.1-16.42.1`	Not reported	SUSE-SU-2017:1794-1	Not reported
Suse	compat-libgcrypt11	rpm	linux enterprise module for legacy 12	`1.5.0-0.6.1`	Not reported	SUSE-SU-2017:1866-1	Not reported
Suse	libgcrypt	rpm	linux enterprise software development kit 11 sp4	`1.5.0-0.25.1`	Not reported	SUSE-SU-2017:1793-1	Not reported
Suse	libgcrypt	rpm	linux enterprise server 11 sp4	`1.5.0-0.25.1`	Not reported	SUSE-SU-2017:1793-1	Not reported
Suse	libgcrypt	rpm	linux enterprise server for sap applications 11 sp4	`1.5.0-0.25.1`	Not reported	SUSE-SU-2017:1793-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[dirmngr]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gnupg]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gnupg1]Unknown
Source package: [gnupg1]
Details (2)
- 1.4.23-1.1+b1 · amd64 · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
- 1.4.23-1.1+b1 · arm64 · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
[gnupg1-l10n]Unknown
Source package: [gnupg1]
Details (2)
- 1.4.23-1.1 · all · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
- 1.4.23-1.1 · all · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
[gnupg2]Unknown
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gnupg-agent]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gnupg-l10n]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gnupg-utils]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpg]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpg-agent]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgconf]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgsm]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgv]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgv1]Unknown
Source package: [gnupg1]
Details (2)
- 1.4.23-1.1+b1 · amd64 · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
- 1.4.23-1.1+b1 · arm64 · bookworm
  Fixed · Fixed: 1.4.22-1
  dsa · gnupg1 · debian · bookworm; dsa · gnupg1 · debian · 12
[gpgv2]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgv-static]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpgv-win32]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpg-wks-client]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[gpg-wks-server]Unknown
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Not affected
  dsa · gnupg2 · debian · bookworm
[libgcrypt20]Unknown
Details (4)
- 1.10.1-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.7.8-1
  dsa · libgcrypt20 · debian · bookworm; dsa · libgcrypt20 · debian · 12
- 1.10.1-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.7.8-1
  dsa · libgcrypt20 · debian · bookworm; dsa · libgcrypt20 · debian · 12
- 1.10.1-3+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.7.8-1
  dsa · libgcrypt20 · debian · bookworm; dsa · libgcrypt20 · debian · 12
- 1.10.1-3+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.7.8-1
  dsa · libgcrypt20 · debian · bookworm; dsa · libgcrypt20 · debian · 12

Next results

Observed: Oct 23, 2026, 5:30:42 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]