7.5

CVE-2021-33560: debian debian_linux Observable Discrepancy

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2021-33560MGASA-2021-0294SUSE-SU-2021:14751-1
Published 08-06-2021Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2021-33560 is a high (CVSS 7.5) Observable Discrepancy vulnerability in debian debian_linux. EPSS estimates a 2.37% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
2.37%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2024:10941-1USN-5080-1USN-5080-2

Timeline

  1. 08-06-2021
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

2.37%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

+0.03 pp

From 2.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse32 products
  • libgcrypt&distro=HPE Helion OpenStack 8< 1.6.1-16.77.1
  • libgcrypt&distro=SUSE Enterprise Storage 6< 1.8.2-8.39.1
  • libgcrypt&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.8.2-8.39.1
  • libgcrypt&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.8.2-8.39.1
  • libgcrypt&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.8.2-6.52.1
Oracle5 products
Redhat5 products
  • libgcrypt< 0:1.8.5-6.el8
  • libgcrypt-debuginfo< 0:1.8.5-6.el8
  • libgcrypt-debugsource< 0:1.8.5-6.el8
  • libgcrypt-devel< 0:1.8.5-6.el8
  • libgcrypt-devel-debuginfo< 0:1.8.5-6.el8
Debian2 products
Mageia2 products
  • libgcrypt< 1.8.5-1.1.mga7
  • libgcrypt< 1.8.7-1.1.mga8
Opensuse2 products
  • libgcrypt&distro=openSUSE Leap 15.2< 1.8.2-lp152.17.3.1
  • libgcrypt&distro=openSUSE Leap 15.3< 1.8.2-8.39.1
Alpine1 product
  • libgcrypt≥ 1.9.0, < 1.8.8-r0 | ≥ 1.9.0, < 1.9.4-r0
Fedoraproject1 product
Gnupg1 product
Ubuntu1 product
  • libgcrypt20< 1.6.5-2ubuntu0.6+esm1 | < 1.8.1-4ubuntu1.3 | < 1.8.1-4ubuntu1.fips.3 | All versions (No fix recorded) | < 1.8.5-5ubuntu1.1 | < 1.8.5-5ubuntu1.fips.1.1 | < 1.8.7-5ubuntu2

10 vendors · 52 products

References

39 links
Show all 39 references