CVE-2021-40528

Katalog CVE

CVSS 5.9 · Medium EPSS 1,4%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada gnupg libgcrypt. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Rincian

Terbit di NVD

6 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://eprint.iacr.org/2021/923 deskripsi teknis · advisory pihak ketiga
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 advisory pihak ketiga
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-13 advisory pihak ketiga
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d88613...