Arch Linux Security Advisory ASA-201709-13 ========================================== Severity: Medium Date : 2017-09-18 CVE-ID : CVE-2017-0379 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-402 Summary ======= The package libgcrypt before version 1.8.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.8.1-1. # pacman -Syu "libgcrypt>=1.8.1-1" The problem has been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== Libgcrypt before 1.8.1 does not properly consider Curve25519 side- channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. On multi user systems or on boxes with virtual machines this attack may be used to steal private keys. Impact ====== On a multi user system or on boxes with virtual machines a local attacker may be able to perform a side-channel attack to steal private keys. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000414.html https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=bf76... https://eprint.iacr.org/2017/806 https://security.archlinux.org/CVE-2017-0379