CVE Catalog
CVE-2019-13627
MediumSummary
A timing attack vulnerability on the ECDSA algorithm was discovered in the libgcrypt20 cryptographic library. An attacker can exploit timing differences in cryptographic operations to recover the private key.
Risk Assessment
The risk involves potential theft of ECDSA private keys, which could lead to user impersonation, data integrity breaches, and encryption compromise.
Recommendation
Immediately update libgcrypt20 to version 1.8.5-2 or later (for Debian 9 and 10) and 1.6.3-2+deb8u7 (for Debian 8).
Original NVD description (English source)
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.