Search for vulnerabilities
Vulnerability details: VCID-sjza-hk7v-aaag
Vulnerability ID VCID-sjza-hk7v-aaag
Aliases CVE-2014-5270
Summary Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
generic_textual Medium http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5270.html
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00142 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.00142 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2014-5270
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1128531
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2014-5270
generic_textual Medium https://ubuntu.com/security/notices/USN-2339-1
generic_textual Medium https://ubuntu.com/security/notices/USN-2339-2
Reference id Reference type URL
http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
http://openwall.com/lists/oss-security/2014/08/16/2
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5270.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-5270.json
https://api.first.org/data/v1/epss?cve=CVE-2014-5270
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270
https://ubuntu.com/security/notices/USN-2339-1
https://ubuntu.com/security/notices/USN-2339-2
http://www.cs.tau.ac.il/~tromer/handsoff/
http://www.debian.org/security/2014/dsa-3024
http://www.debian.org/security/2014/dsa-3073
1128531 https://bugzilla.redhat.com/show_bug.cgi?id=1128531
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.4.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.4.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.4.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.4.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.5.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.5.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:1.5.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnupg:libgcrypt:1.5.2:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
CVE-2014-5270 https://nvd.nist.gov/vuln/detail/CVE-2014-5270
GLSA-201408-10 https://security.gentoo.org/glsa/201408-10
USN-2339-1 https://usn.ubuntu.com/2339-1/
USN-2339-2 https://usn.ubuntu.com/2339-2/
USN-2554-1 https://usn.ubuntu.com/2554-1/
No exploits are available.
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2014-5270
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.19235
EPSS Score 0.00072
Published At April 8, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.