Every CVE Search/ Get API key

CVE-2017-9526

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel...

5.9 MediumFix available

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.32%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
CVE-2017-9526
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
CVE-2017-9526
Updated
2026-11-02
EUVDEUVD-2017-18457 No score

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
EUVD-2017-18457
Updated
2026-11-03
GitHub AdvisoriesGHSA-665h-28h9-qh6v 5.9

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel...

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
GHSA-665h-28h9-qh6v
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVBELL-CVE-2017-9526 5.9

CVE-2017-9526 does not affect BellSoft software

Record
BELL-CVE-2017-9526
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 5.9

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
CVE-2017-9526
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2017-9526 5.9

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
DEBIAN-CVE-2017-9526
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-9526 5.9

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.

Record
UBUNTU-CVE-2017-9526
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVSUSE-SU-2017:1608-1 No score

Security update for libgcrypt

This update for libgcrypt fixes the following issues:

  • CVE-2017-9526: Store the session key in secure memory to ensure that constant time point operations are used in the MPI library. (bsc#1042326)

  • Don't require secure memory for the fips selftests, this prevents the 'Oops, secure memory pool already initialized' warning. (bsc#931932)

Record
SUSE-SU-2017:1608-1
Updated
2026-11-02
OSVUSN-3347-1 No score

libgcrypt11, libgcrypt20 vulnerabilities

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this attack to recover RSA private keys. (CVE-2017-7526)

It was discovered that Libgcrypt was susceptible to an attack via side channels. A local attacker could use this attack to possibly recover EdDSA private keys. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-9526)

Record
USN-3347-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libgcrypt20
Debian:12
 before 1.7.6-2
1.7.6-2
libgcrypt20
Debian:13
 before 1.7.6-2
1.7.6-2
libgcrypt20
Debian:14
 before 1.7.6-2
1.7.6-2
libgcrypt20
Debian:8
 before 1.6.3-2+deb8u3, plus listed versions
1.6.3-21.6.3-2+deb8u11.6.3-2+deb8u2
1.6.3-2+deb8u3
libgcrypt
SUSE:Linux Enterprise Desktop 12 SP2
 before 1.6.1-16.39.1
1.6.1-16.39.1
libgcrypt
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 1.6.1-16.39.1
1.6.1-16.39.1
libgcrypt
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 1.6.1-16.39.1
1.6.1-16.39.1
libgcrypt
SUSE:Linux Enterprise Server 12 SP2
 before 1.6.1-16.39.1
1.6.1-16.39.1
libgcrypt
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 1.6.1-16.39.1
1.6.1-16.39.1
libgcrypt20
Ubuntu:16.04:LTS
 before 1.6.5-2ubuntu0.3, plus listed versions
1.6.3-2ubuntu11.6.4-31.6.4-41.6.4-51.6.5-21.6.5-2ubuntu0.2
1.6.5-2ubuntu0.3
libgcrypt11
Ubuntu:14.04:LTS
 before 1.5.3-2ubuntu4.5, plus listed versions
1.5.0-3ubuntu31.5.3-2ubuntu11.5.3-2ubuntu41.5.3-2ubuntu4.11.5.3-2ubuntu4.21.5.3-2ubuntu4.31.5.3-2ubuntu4.4
1.5.3-2ubuntu4.5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9526 is a medium vulnerability (CVSS 5.9) in Gnupg Libgcrypt, published June 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in libgcrypt20 1.7.6-2.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open