| Summary: | libgcrypt new security issue CVE-2018-0495 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | herman.viaene, jani.valimaa, marja11, mhrambo3501, sysadmin-bugs |
| Version: | 5 | Keywords: | advisory, has_procedure, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA5-32-OK | ||
| Source RPM: | libgcrypt-1.5.4-5.4.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | 23185 | ||
| Bug Blocks: | |||
|
Description
David Walser
2018-06-20 23:40:51 CEST
Assigning to all packagers collectively, since there is no registered maintainer for this package. CC:
(none) =>
marja11 Thanks Jani! Advisory: ======================== Updated libgcrypt packages fix security vulnerability: When libgcrypt uses the private key to create a signature, such as for a TLS or SSH connection, it inadvertently leaks information through memory caches. An unprivileged attacker running on the same machine can collect the information from a few thousand signatures and recover the value of the private ECDSA or DSA key (CVE-2018-0495). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495 https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ ======================== Updated packages in core/updates_testing: ======================== libgcrypt11-1.5.4-5.5.mga5 libgcrypt-devel-1.5.4-5.5.mga5 from libgcrypt-1.5.4-5.5.mga5.src.rpm Assignee:
pkg-bugs =>
qa-bugs MGA5-32 on Dell Latitude D600 Xfce No installation issues Followed testing as bug 17742 Comment 4 $ gpg2 --list-keys nothing found $ gpg --gen-key Real name hviaene , etc..... $ gpg2 --list-keys ( works ) $ gpg2 -e -r hviaene foo.diff generates file foo.diff.gpg rename foo.diff to foo.diff.orig $ gpg2 foo.diff.gpg generates file foo.diff, contents OK $ gpg2 --delete-secret-keys hviaene answering y on questions works OK $ gpg2 --delete-key hviaene idem $ gpg2 --list-keys nothing found Seems good to go. CC:
(none) =>
herman.viaene Validating. Advisoried. Keywords:
(none) =>
advisory, has_procedure, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0306.html Status:
NEW =>
RESOLVED |