Security update for libgcrypt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1179-1 Final 1 1 2015-06-11T13:44:58Z current 2015-06-11T13:44:58Z 2015-06-11T13:44:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libgcrypt This update of libgcrypt fixes one security issue and brings various FIPS 140-2 related improvements. libgcrypt now uses ciphertext blinding for Elgamal decryption (CVE-2014-3591) FIPS 140-2 related changes: * The library performs its self-tests when the module is complete (the -hmac file is also installed). * Added a NIST 800-90a compliant DRBG. * Change DSA key generation to be FIPS 186-4 compliant. * Change RSA key generation to be FIPS 186-4 compliant. * Enable HW support in fips mode (bnc#896435) * Make DSA selftest use 2048 bit keys (bnc#898003) * Added ECDSA selftests and add support for it to the CAVS testing framework (bnc#896202) * Various CAVS testing improvements. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-296,SUSE-SLE-SDK-12-2015-296,SUSE-SLE-SERVER-12-2015-296 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151179-1/ Link for SUSE-SU-2015:1179-1 https://lists.suse.com/pipermail/sle-security-updates/2015-July/001473.html E-Mail link for SUSE-SU-2015:1179-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/896202 SUSE Bug 896202 https://bugzilla.suse.com/896435 SUSE Bug 896435 https://bugzilla.suse.com/898003 SUSE Bug 898003 https://bugzilla.suse.com/899524 SUSE Bug 899524 https://bugzilla.suse.com/900275 SUSE Bug 900275 https://bugzilla.suse.com/900276 SUSE Bug 900276 https://bugzilla.suse.com/905483 SUSE Bug 905483 https://bugzilla.suse.com/920057 SUSE Bug 920057 https://bugzilla.suse.com/928740 SUSE Bug 928740 https://bugzilla.suse.com/929919 SUSE Bug 929919 https://www.suse.com/security/cve/CVE-2014-3591/ SUSE CVE CVE-2014-3591 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libgcrypt20-1.6.1-13.1 libgcrypt20-32bit-1.6.1-13.1 libgcrypt-devel-1.6.1-13.1 libgcrypt20-hmac-1.6.1-13.1 libgcrypt20-hmac-32bit-1.6.1-13.1 libgcrypt20-1.6.1-13.1 as a component of SUSE Linux Enterprise Desktop 12 libgcrypt20-32bit-1.6.1-13.1 as a component of SUSE Linux Enterprise Desktop 12 libgcrypt20-1.6.1-13.1 as a component of SUSE Linux Enterprise Server 12 libgcrypt20-32bit-1.6.1-13.1 as a component of SUSE Linux Enterprise Server 12 libgcrypt20-hmac-1.6.1-13.1 as a component of SUSE Linux Enterprise Server 12 libgcrypt20-hmac-32bit-1.6.1-13.1 as a component of SUSE Linux Enterprise Server 12 libgcrypt20-1.6.1-13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgcrypt20-32bit-1.6.1-13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgcrypt20-hmac-1.6.1-13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgcrypt20-hmac-32bit-1.6.1-13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgcrypt-devel-1.6.1-13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication. CVE-2014-3591 SUSE Linux Enterprise Desktop 12:libgcrypt20-1.6.1-13.1 SUSE Linux Enterprise Desktop 12:libgcrypt20-32bit-1.6.1-13.1 SUSE Linux Enterprise Server 12:libgcrypt20-1.6.1-13.1 SUSE Linux Enterprise Server 12:libgcrypt20-32bit-1.6.1-13.1 SUSE Linux Enterprise Server 12:libgcrypt20-hmac-1.6.1-13.1 SUSE Linux Enterprise Server 12:libgcrypt20-hmac-32bit-1.6.1-13.1 SUSE Linux Enterprise Server for SAP Applications 12:libgcrypt20-1.6.1-13.1 SUSE Linux Enterprise Server for SAP Applications 12:libgcrypt20-32bit-1.6.1-13.1 SUSE Linux Enterprise Server for SAP Applications 12:libgcrypt20-hmac-1.6.1-13.1 SUSE Linux Enterprise Server for SAP Applications 12:libgcrypt20-hmac-32bit-1.6.1-13.1 SUSE Linux Enterprise Software Development Kit 12:libgcrypt-devel-1.6.1-13.1 moderate 4.3 AV:A/AC:H/Au:S/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151179-1/ https://www.suse.com/security/cve/CVE-2014-3591.html CVE-2014-3591 https://bugzilla.suse.com/920057 SUSE Bug 920057 https://bugzilla.suse.com/949135 SUSE Bug 949135