6.3

CVE-2019-13627: canonical ubuntu_linux Observable Discrepancy

Modified
AliasesALPINE-CVE-2019-13627MGASA-2019-0256SUSE-SU-2019:2349-1
Published 25-09-2019Last modified 14-10-2026

Vulnerability summary

CVE-2019-13627 is a medium (CVSS 6.3) Observable Discrepancy vulnerability in canonical ubuntu_linux. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.9% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v3.1 (NVD)
EPSS score
0.55%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10941-1

Timeline

  1. 25-09-2019
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

CVSS metrics

6 scores · 5 sources · 3 versions

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.51% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse23 products
  • libgcrypt&distro=HPE Helion OpenStack 8< 1.6.1-16.68.1
  • libgcrypt&distro=SUSE Enterprise Storage 4< 1.6.1-16.68.1
  • libgcrypt&distro=SUSE Enterprise Storage 5< 1.6.1-16.68.1
  • libgcrypt&distro=SUSE Linux Enterprise Desktop 12 SP4< 1.6.1-16.68.1
  • libgcrypt&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.8.2-6.20.1
Redhat5 products
  • libgcrypt< 0:1.8.5-4.el8
  • libgcrypt-debuginfo< 0:1.8.5-4.el8
  • libgcrypt-debugsource< 0:1.8.5-4.el8
  • libgcrypt-devel< 0:1.8.5-4.el8
  • libgcrypt-devel-debuginfo< 0:1.8.5-4.el8
Opensuse3 products
  • leapEOL15.0 | 15.1
  • libgcrypt&distro=openSUSE Leap 15.0< 1.8.2-lp150.5.13.1
  • libgcrypt&distro=openSUSE Leap 15.1< 1.8.2-lp151.9.7.1
Ubuntu2 products
  • libgcrypt11< 1.5.3-2ubuntu4.6+esm1
  • libgcrypt20< 1.8.1-4ubuntu1.2 | < 1.6.5-2ubuntu0.6
Alpine1 product
  • libgcrypt< 1.8.5-r0
Canonical1 product
  • ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04 | 19.10
Debian1 product
  • libgcrypt20< 1.6.3-2+deb8u6 | < 1.6.3-2+deb8u8 | < 1.8.5-1
Libgcrypt20_project1 product
Mageia1 product
  • libgcrypt< 1.8.5-1.mga7

9 vendors · 38 products

References

41 links
Show all 41 references