Libgcrypt: Side-channel attack A vulnerability in Libgcrypt could allow a local attacker to recover sensitive information. libgcrypt 2020-03-15 2020-03-15 693108 local 1.8.5 1.8.5

Libgcrypt is a general purpose cryptographic library derived out of GnuPG.

A timing attack was found in the way ECCDSA was implemented in Libgcrypt.

A local man-in-the-middle attacker, during signature generation, could possibly recover the private key.

There is no known workaround at this time.

All Libgcrypt users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libgcrypt-1.8.5" CVE-2019-13627 whissi whissi