Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Published

2014-10-10T01:55:10.383

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 2.1 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gnupg libgcrypt ≤ 1.5.3 Yes
Application gnupg libgcrypt 1.4.0 Yes
Application gnupg libgcrypt 1.4.3 Yes
Application gnupg libgcrypt 1.4.4 Yes
Application gnupg libgcrypt 1.4.5 Yes
Application gnupg libgcrypt 1.4.6 Yes
Application gnupg libgcrypt 1.5.0 Yes
Application gnupg libgcrypt 1.5.1 Yes
Application gnupg libgcrypt 1.5.2 Yes
Operating System debian debian_linux 7.0 Yes
References