CVE Vulnerability

CVE-2018-6829

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html Issue Tracking Third Party Advisory
https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki Exploit Third Party Advisory
https://github.com/weikengchen/attack-on-libgcrypt-elgamal Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Configurations

Configuration 1

cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*
Information

Published : 2018-02-07 11:29

Updated : 2020-01-15 08:15

NVD link : CVE-2018-6829

Mitre link : CVE-2018-6829

Products Affected
No products.
CWE
CWE-327