CVE-2017-7526: canonical ubuntu_linux
CVSS: 6.8v3.0MediumModified
AliasesALPINE-CVE-2017-7526MGASA-2017-0213MGASA-2017-0235SUSE-SU-2017:1793-1SUSE-SU-2017:1794-1SUSE-SU-2017:1866-1UBUNTU-CVE-2017-7526USN-3733-1DEBIAN-CVE-2017-7526DLA-1015-1DLA-1080-1DSA-3901-1DSA-3960-1
Published 26-07-2018Last modified 17-12-2025
Vulnerability summary
CVE-2017-7526 is a medium (CVSS 6.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.84% chance of exploitation in the next 30 days, higher than 89.9% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.0 (NVD)EPSS score
3.84%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 26-07-2018PublishedVulnerability first disclosed.
- 17-12-2025Last modifiedVulnerability information updated.
Description
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NSources5 sources · 6.1–6.8
- CVE.orgCNA6.1MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
3.84%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.05 pp
From 3.89% on 18-09-2026
18-09-202618-10-2026
EPSS score3.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Affected systems
Suse9 products
- compat-libgcrypt11&distro=SUSE Linux Enterprise Module for Legacy 12< 1.5.0-0.6.1
- libgcrypt&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.6.1-16.42.1
- libgcrypt&distro=SUSE Linux Enterprise Server 11 SP4< 1.5.0-0.25.1
- libgcrypt&distro=SUSE Linux Enterprise Server 12 SP2< 1.6.1-16.42.1
- libgcrypt&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 1.6.1-16.42.1
Debian5 products
- gnupg< 1.4.18-7+deb8u4 | < 1.4.12-7+deb7u9
- gnupg1< 1.4.22-1
- libgcrypt11< 1.5.0-5+deb7u6
- libgcrypt20< 1.7.8-1 | < 1.6.3-2+deb8u4 | < 1.7.6-2+deb9u1
- debian_linuxEOL8.0 | 9.0
Mageia3 products
- gnupg< 1.4.19-1.3.mga5
- libgcrypt< 1.5.4-5.4.mga5
- gnupg< 1.4.22-1.mga6
Ubuntu3 products
- gnupg< 1.4.16-1ubuntu2.6 | < 1.4.20-1ubuntu3.3
- libgcrypt11< 1.5.3-2ubuntu4.5
- libgcrypt20< 1.6.5-2ubuntu0.3
Alpine1 product
- gnupg1< 1.4.23-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04
Gnupg1 product
- libgcrypt1.7.8 | < 1.7.8
7 vendors · 23 products
References
34 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- git.gnupg.org/cgi-bin/…X Refsource CONFIRM
- lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.htmlMailing ListX Refsource MLISTVendor Advisory
Show all 34 references
- git.gnupg.org/cgi-bin/…X Refsource CONFIRM
- git.gnupg.org/cgi-bin/…X Refsource CONFIRM
