CVE-2014-3591: debian debian_linux
CVSS: 4.2v3.1MediumModified
AliasesSUSE-SU-2015:1179-1UBUNTU-CVE-2014-3591DEBIAN-CVE-2014-3591
Published 29-11-2019Last modified 06-08-2024
Vulnerability summary
CVE-2014-3591 is a medium (CVSS 4.2) vulnerability in debian debian_linux. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities.
CVSS score
4.2/10
010
Medium · v3.1 (NVD)EPSS score
0.60%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Duplicates 1 · Related 4Timeline
- 29-11-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.2Preferred score · NVD (NIST)
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Low 1.9Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.02 pp
From 0.58% on 18-09-2026
18-09-202618-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse4 products
- libgcrypt&distro=SUSE Linux Enterprise Desktop 12< 1.6.1-13.1
- libgcrypt&distro=SUSE Linux Enterprise Server 12< 1.6.1-13.1
- libgcrypt&distro=SUSE Linux Enterprise Server for SAP Applications 12< 1.6.1-13.1
- libgcrypt&distro=SUSE Linux Enterprise Software Development Kit 12< 1.6.1-13.1
Ubuntu3 products
- gnupg< 1.4.16-1ubuntu2.3
- libgcrypt11< 1.5.3-2ubuntu4.2
- libgcrypt20< 1.6.1-2ubuntu1.14.04.1
Debian2 products
- libgcrypt20< 1.6.3-2
- debian_linuxEOL7.0 | 8.0
5 vendors · 13 products
References
23 links- lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.htmlX Refsource MISCPatchRelease NotesVendor AdvisoryREPORT
- lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.htmlX Refsource MISCPatchVendor AdvisoryREPORT
- bugzilla.suse.com/896202REPORT
- bugzilla.suse.com/896435REPORT
- bugzilla.suse.com/898003REPORT
- bugzilla.suse.com/899524REPORT
Show all 23 references
- bugzilla.suse.com/900275REPORT
- bugzilla.suse.com/900276REPORT
- bugzilla.suse.com/905483REPORT
- bugzilla.suse.com/920057REPORT
- bugzilla.suse.com/928740REPORT
- bugzilla.suse.com/929919REPORT
