CVE catalog

CVE-2019-12904

Security update for libgcrypt

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Jun 20, 2019, 12:15:10 AM UTC
Updated: Sep 21, 2026, 6:17:52 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.21% · Oct 25, 2026

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Alpine	libgcrypt	3.10	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.11	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.12	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.13	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.14	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.15	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.16	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.17	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.18	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.19	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.20	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.21	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.22	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.23	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.24	`1.8.4-r2`	fixed
Alpine	libgcrypt	3.7	`1.8.3-r1`	fixed
Alpine	libgcrypt	3.8	`1.8.3-r1`	fixed
Alpine	libgcrypt	3.9	`1.8.4-r1`	fixed
Suse	libgcrypt	linux enterprise module for basesystem 15	`1.8.2-6.17.1`	fixed
Suse	libgcrypt	linux enterprise module for basesystem 15 sp1	`1.8.2-8.6.2`	fixed
Opensuse	libgcrypt	leap 15.0	`1.8.2-lp150.5.10.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Alpine	libgcrypt	apk	3.10	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.11	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.12	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.13	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.14	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.15	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.16	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.17	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.18	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.19	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.20	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.21	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.22	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.23	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.24	`1.8.4-r2`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.7	`1.8.3-r1`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.8	`1.8.3-r1`	Not reported	ALPINE-CVE-2019-12904	Not reported
Alpine	libgcrypt	apk	3.9	`1.8.4-r1`	Not reported	ALPINE-CVE-2019-12904	Not reported
Suse	libgcrypt	rpm	linux enterprise module for basesystem 15	`1.8.2-6.17.1`	Not reported	SUSE-SU-2019:1859-1	Not reported
Suse	libgcrypt	rpm	linux enterprise module for basesystem 15 sp1	`1.8.2-8.6.2`	Not reported	SUSE-SU-2019:1971-1	Not reported
Opensuse	libgcrypt	rpm	leap 15.0	`1.8.2-lp150.5.10.1`	Not reported	OPENSUSE-SU-2019:1792-1	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 5:39:47 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]