Search for vulnerabilities
Vulnerability details: VCID-6546-cx94-aaah
Vulnerability ID VCID-6546-cx94-aaah
Aliases CVE-2021-33560
Summary Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-203 Observable Discrepancy
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-33560.html
rhas Moderate https://access.redhat.com/errata/RHSA-2021:4409
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33560.json
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00478 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0053 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0053 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.0057 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00649 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.00718 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
epss 0.08992 https://api.first.org/data/v1/epss?cve=CVE-2021-33560
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1970096
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560
generic_textual Medium https://eprint.iacr.org/2021/923
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-33560
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-33560
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-33560
archlinux Medium https://security.archlinux.org/AVG-2011
archlinux Medium https://security.archlinux.org/AVG-2012
archlinux Medium https://security.archlinux.org/AVG-2013
archlinux Medium https://security.archlinux.org/AVG-2014
generic_textual Medium https://ubuntu.com/security/notices/USN-5080-1
generic_textual Medium https://ubuntu.com/security/notices/USN-5080-2
cvssv3.1 5.3 https://www.oracle.com/security-alerts/cpuapr2022.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuapr2022.html
cvssv3.1 6.6 https://www.oracle.com/security-alerts/cpujan2022.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpujan2022.html
cvssv3.1 7.5 https://www.oracle.com/security-alerts/cpujul2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujul2022.html
cvssv3.1 8.2 https://www.oracle.com/security-alerts/cpuoct2021.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpuoct2021.html
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-33560.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33560.json
https://api.first.org/data/v1/epss?cve=CVE-2021-33560
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560
https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61
https://dev.gnupg.org/T5305
https://dev.gnupg.org/T5328
https://dev.gnupg.org/T5466
https://eprint.iacr.org/2021/923
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/
https://security.gentoo.org/glsa/202210-13
https://ubuntu.com/security/notices/USN-5080-1
https://ubuntu.com/security/notices/USN-5080-2
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
1970096 https://bugzilla.redhat.com/show_bug.cgi?id=1970096
AVG-2011 https://security.archlinux.org/AVG-2011
AVG-2012 https://security.archlinux.org/AVG-2012
AVG-2013 https://security.archlinux.org/AVG-2013
AVG-2014 https://security.archlinux.org/AVG-2014
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
CVE-2021-33560 https://nvd.nist.gov/vuln/detail/CVE-2021-33560
RHSA-2021:4409 https://access.redhat.com/errata/RHSA-2021:4409
USN-5080-1 https://usn.ubuntu.com/5080-1/
USN-5080-2 https://usn.ubuntu.com/5080-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33560.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33560
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33560
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-33560
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpujan2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.oracle.com/security-alerts/cpujul2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://www.oracle.com/security-alerts/cpuoct2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56455
EPSS Score 0.00189
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.