Open mend-for-github-com[bot] opened 1 year ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
Vulnerable Library - clientsoftwarelibgcrypt-1.5.1
Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Vulnerable Source Files (3)
/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2021-3345
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/cipher/hash-common.c /release/src/router/libgcrypt-1.5.1/cipher/hash-common.c /release/src/router/libgcrypt-1.5.1/cipher/hash-common.c
### Vulnerability Details_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.
Publish Date: 2021-01-29
URL: CVE-2021-3345
### CVSS 3 Score Details (7.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3345
Release Date: 2021-01-29
Fix Resolution: libgcrypt-1.9.1
CVE-2021-33560
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c
### Vulnerability DetailsLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Publish Date: 2021-06-08
URL: CVE-2021-33560
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560
Release Date: 2021-06-08
Fix Resolution: libgcrypt-1.9.3
CVE-2018-6829
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c
### Vulnerability Detailscipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.
Publish Date: 2018-02-07
URL: CVE-2018-6829
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-6829
Release Date: 2018-02-07
Fix Resolution: libgcrypt - 1.9.3
CVE-2017-0379
### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
Publish Date: 2017-08-29
URL: CVE-2017-0379
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0379
Release Date: 2017-08-29
Fix Resolution: 1.8.1
CVE-2017-7526
### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
Publish Date: 2018-07-26
URL: CVE-2017-7526
### CVSS 3 Score Details (6.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-7526
Release Date: 2018-07-26
Fix Resolution: 1.7.8
CVE-2019-13627
### Vulnerable Libraries - clientsoftwarelibgcrypt-1.5.1, clientsoftwarelibgcrypt-1.5.1It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
Publish Date: 2019-09-25
URL: CVE-2019-13627
### CVSS 3 Score Details (6.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://gitlab.alpinelinux.org/alpine/aports/issues/10823
Release Date: 2019-09-25
Fix Resolution: 1.8.5
CVE-2015-0837
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c
### Vulnerability DetailsThe mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Publish Date: 2019-11-29
URL: CVE-2015-0837
### CVSS 3 Score Details (5.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837
Release Date: 2019-11-29
Fix Resolution: libgcrypt-1.6.3
CVE-2016-6313
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/random/random-csprng.c /release/src/router/libgcrypt-1.5.1/random/random-csprng.c /release/src/router/libgcrypt-1.5.1/random/random-csprng.c
### Vulnerability DetailsThe mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
Publish Date: 2016-12-13
URL: CVE-2016-6313
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-6313
Release Date: 2016-12-13
Fix Resolution: libgcrypt-1.5.6,1.6.6,1.7.3, GnuPG-1.4.21
CVE-2014-3591
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c /release/src/router/libgcrypt-1.5.1/cipher/elgamal.c
### Vulnerability DetailsLibgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
Publish Date: 2019-11-29
URL: CVE-2014-3591
### CVSS 3 Score Details (4.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Physical - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3591
Release Date: 2015-03-03
Fix Resolution: libgcrypt-1.6.3
CVE-2014-5270
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c /release/src/router/libgcrypt-1.5.1/mpi/mpi-pow.c
### Vulnerability DetailsLibgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
Publish Date: 2014-10-10
URL: CVE-2014-5270
### CVSS 3 Score Details (4.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-5270
Release Date: 2014-10-10
Fix Resolution: 1.5.4
CVE-2015-7511
### Vulnerable Library - clientsoftwarelibgcrypt-1.5.1Client Software for Imprint Management
Library home page: https://github.com/WaveLLC/clientsoftware.git
Found in HEAD commit: 0c45ce909374d16605095db4fce9a89b9b6bafd5
Found in base branch: master
### Vulnerable Source Files (3)/release/src/router/libgcrypt-1.5.1/mpi/ec.c /release/src/router/libgcrypt-1.5.1/mpi/ec.c /release/src/router/libgcrypt-1.5.1/mpi/ec.c
### Vulnerability DetailsLibgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Publish Date: 2016-04-19
URL: CVE-2015-7511
### CVSS 3 Score Details (2.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Physical - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-7511
Release Date: 2016-04-19
Fix Resolution: 1.6.5