ESB-2021.2234 – [Debian] libgcrypt20: Access confidential data – Remote/unauthenticated

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.2234
libgcrypt20 security update
25 June 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: libgcrypt20
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Access Confidential Data — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-33560

Reference: ESB-2021.2188

Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html

– ————————–BEGIN INCLUDED TEXT——————–

– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– – ————————————————————————-
Debian LTS Advisory DLA-2691-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Thorsten Alteholz
June 25, 2021 https://wiki.debian.org/LTS
– – ————————————————————————-

Package : libgcrypt20
Version : 1.7.6-2+deb9u4
CVE ID : CVE-2021-33560

An issue has been found in libgcrypt20, a crypto library.
Mishandling of ElGamal encryption results in a possible side-channel
attack and an interoperability problem with keys not generated by
GnuPG/libgcrypt.

For Debian 9 stretch, this problem has been fixed in version
1.7.6-2+deb9u4.

We recommend that you upgrade your libgcrypt20 packages.

For the detailed security status of libgcrypt20 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libgcrypt20

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

– —–BEGIN PGP SIGNATURE—–

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmDVDXZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEcF5RAAlPb0kR++fKd+iA8bWvonSqPVxtAx0/D2LlpW52QEgNIM7o0Y/M8lIIEh
YFRCQ4VVjgKjw/G8NfiE5l2/mUxjh9ctdUCGnBnZtnCilNNYyuDFbrRAdFN38iKU
et9zgEgnel2VAN3DK+2HwaJboahDkfNkFPtbI71wNWnRzTMzAoPnXtV4EpYLbxK1
QAfutqTNxssOyGUH1HBp5cGU7M5unfzA6GZRKRsV7Faw8TraRkEbpxNrNsubF1Zl
dKI6spK4bWYGzKrxRlpE446EYUDmS5QcMHmX0q87puGNPjQKe5kIecb6yDWa3P+m
/SS7upnMmEvyAzNynTJGFMikIZbHxcsUGmgjw0JnrxoEG+m7AqDjrKt1tpyN5D+e
z7GlEgGqeHppUE/v2Xx1ccvKktkRynuN5R14dPpl8C5ODk8OGQLMTNQw0kBmzpEn
ZNjFmmYZtJBPT2LGKg90phmVkARl7aqGXOJ7ZUFFjUPn7X29qpUI0A7zVmHcMXsd
asGDxQ7Ld3ANFCzKzwIigckyxn+QxvqupdfIw42JuRvwvZEwQXeILaG1Jlh5Os87
oDT/VSGtnO3PHJRc37fGjeOUOhYitOlvfEiI9SOCM6hYDjFPBDH70PSXRlnhsQDK
C+dVhQN2BGfwFxHvgl0OmumBhM++SqA1BLOrg43zXZuWShOA7OM=
=W1FO
– —–END PGP SIGNATURE—–

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYNUqFuNLKJtyKPYoAQgmtw/9F/rmJxvTD5ZmKjgIgF0geVX9OkUoSsLq
cV/IsTSgfo5K+sr1QEMQhZ69ogUOqcwHtCq5onUt3lN+vktsFigvuE6/xyopCCUE
gMTtM075QzK8jlouXgeO07oQbUy/hC3h1Qgj7wKIjTChC3dXX9KUILk226p45Izt
evW0+LRR5NcM5bsg3wGKCnN239Ue8mjNXMvt5FCWG7H2ANpj8f3nPnm3tvuz67p6
q783/zqs+mHTBgGMBWMsDPBd3iSoVn69XFIcyX12khg7sccfVni9V2xhWBfYxMjR
HbvzTDb/cCr52NidtcFXxew/gUvcxfSbnm2z/mzPNV07Xg90IC3c+h9YVZ92dd2N
ZFnSh628BJQCs/pmFrXvF5P+p3Mh4ZxjH49evbCBway7062aIBKGZjd3W1zQTmAr
HGA7uXF7ea4vQHY0aE+nx/4MPAzsMYc3S44eQ7S0rq6bLlsLf/VYfeFy0msfpvAa
vROU2Wf8NFIpEsPFA426gekJps3x/5OBkeSMZ2zC28jLN/cW5UCGQfQYeA43lCxz
UX6ngxs/DIbhSZKif9OdW/9AuaL5OJwi8BY1L8PluBoEgcke4LB622oPTTW59FvZ
HL1eCamESVSFfxTos5vqqJPEvSccvBe3VA+Jj+tgPoe8OgN09Um6cOc4RA7xmkb9
38+sqIKMx5U=
=Pqwb
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.2234 – [Debian] libgcrypt20: Access confidential data – Remote/unauthenticated appeared first on Malware Devil.

https://malwaredevil.com/2021/06/25/esb-2021-2234-debian-libgcrypt20-access-confidential-data-remote-unauthenticated/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-2234-debian-libgcrypt20-access-confidential-data-remote-unauthenticated