search

Chiencc / asuswrt-gt-ac5300

asuswrt-gt-ac5300
Other
0 stars 0 forks source link

clientsoftwarelibgcrypt-1.5.1: 11 vulnerabilities (highest severity is: 7.8) - autoclosed #31

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (clientsoftwarelibgcrypt version) Remediation Available
CVE-2021-3345 High 7.8 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt-1.9.1 ❌
CVE-2021-33560 High 7.5 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt-1.9.3 ❌
CVE-2018-6829 High 7.5 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt - 1.9.3 ❌
CVE-2017-0379 High 7.5 detected in multiple dependencies Direct 1.8.1 ❌
CVE-2017-7526 Medium 6.8 detected in multiple dependencies Direct 1.7.8 ❌
CVE-2019-13627 Medium 6.3 detected in multiple dependencies Direct 1.8.5 ❌
CVE-2015-0837 Medium 5.9 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt-1.6.3 ❌
CVE-2016-6313 Medium 5.3 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt-1.5.6,1.6.6,1.7.3, GnuPG-1.4.21 ❌
CVE-2014-3591 Medium 4.2 clientsoftwarelibgcrypt-1.5.1 Direct libgcrypt-1.6.3 ❌
CVE-2014-5270 Medium 4.0 clientsoftwarelibgcrypt-1.5.1 Direct 1.5.4 ❌
CVE-2015-7511 Low 2.0 clientsoftwarelibgcrypt-1.5.1 Direct 1.6.5 ❌

Details

CVE-2021-3345 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/cipher/hash-common.c /release/src/router/libgcrypt-1.5.1/cipher/hash-common.c /release/src/router/libgcrypt-1.5.1/cipher/hash-common.c

### Vulnerability Details

_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.

Publish Date: 2021-01-29

URL: CVE-2021-3345

### CVSS 3 Score Details (7.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3345

Release Date: 2021-01-29

Fix Resolution: libgcrypt-1.9.1

CVE-2021-33560 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c

### Vulnerability Details

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Publish Date: 2021-06-08

URL: CVE-2021-33560

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560

Release Date: 2021-06-08

Fix Resolution: libgcrypt-1.9.3

CVE-2018-6829 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c

### Vulnerability Details

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

Publish Date: 2018-02-07

URL: CVE-2018-6829

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-6829

Release Date: 2018-02-07

Fix Resolution: libgcrypt - 1.9.3

CVE-2017-0379 ### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1

### Vulnerability Details

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Publish Date: 2017-08-29

URL: CVE-2017-0379

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0379

Release Date: 2017-08-29

Fix Resolution: 1.8.1

CVE-2017-7526 ### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1

### Vulnerability Details

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

Publish Date: 2018-07-26

URL: CVE-2017-7526

### CVSS 3 Score Details (6.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-7526

Release Date: 2018-07-26

Fix Resolution: 1.7.8

CVE-2019-13627 ### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1

### Vulnerability Details

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

Publish Date: 2019-09-25

URL: CVE-2019-13627

### CVSS 3 Score Details (6.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://gitlab.alpinelinux.org/alpine/aports/issues/10823

Release Date: 2019-09-25

Fix Resolution: 1.8.5

CVE-2015-0837 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c

### Vulnerability Details

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Publish Date: 2019-11-29

URL: CVE-2015-0837

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837

Release Date: 2019-11-29

Fix Resolution: libgcrypt-1.6.3

CVE-2016-6313 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/random/random-csprng.c /release/src/router/libgcrypt-1.5.1/random/random-csprng.c /release/src/router/libgcrypt-1.5.1/random/random-csprng.c

### Vulnerability Details

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

Publish Date: 2016-12-13

URL: CVE-2016-6313

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-6313

Release Date: 2016-12-13

Fix Resolution: libgcrypt-1.5.6,1.6.6,1.7.3, GnuPG-1.4.21

CVE-2014-3591 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c

### Vulnerability Details

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Publish Date: 2019-11-29

URL: CVE-2014-3591

### CVSS 3 Score Details (4.2)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Physical - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3591

Release Date: 2015-03-03

Fix Resolution: libgcrypt-1.6.3

CVE-2014-5270 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (3)

/release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c

### Vulnerability Details

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Publish Date: 2014-10-10

URL: CVE-2014-5270

### CVSS 3 Score Details (4.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-5270

Release Date: 2014-10-10

Fix Resolution: 1.5.4

CVE-2015-7511 ### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1

Client Software for Imprint Management

Library home page: https://github.com/WaveLLC/clientsoftware.git

Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5

Found in base branch: master

### Vulnerable Source Files (1)

### Vulnerability Details

Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.

Publish Date: 2016-04-19

URL: CVE-2015-7511

### CVSS 3 Score Details (2.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Physical - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-7511

Release Date: 2016-04-19

Fix Resolution: 1.6.5

mend-for-github-com[bot] commented 1 year ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #33

mend-for-github-com[bot] commented 1 year ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #33