CVE-2013-4242

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other...

1.9 LowFix available

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.

Exploit likelihood

0.53%Down 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 1.9

Record: CVE-2013-4242
CVSS 2.0: 1.9 LowAV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4242
Updated: 2026-11-02

EUVDEUVD-2013-4146 No score

Record: EUVD-2013-4146
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rpp2-q7rq-p78j No score

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other...

Record: GHSA-rpp2-q7rq-p78j
Weakness: CWE-200
Updated: 2026-11-02

OSVMGASA-2013-0239 No score

Updated gnupg package fixes security vulnerability

Yarom and Falkner discovered that RSA secret keys in applications using GnuPG 1.x, and using the libgcrypt library, could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system (CVE-2013-4242).

Record: MGASA-2013-0239
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10037-1 No score

libgcrypt-cavs-1.7.3-1.3 on GA media

These are all security issues fixed in the libgcrypt-cavs-1.7.3-1.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10037-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gnupg` Debian:6.0	before 1.4.10-4+squeeze2, plus listed versions 1.4.10-41.4.10-4+squeeze1	1.4.10-4+squeeze2
`gnupg` Debian:7	before 1.4.12-7+deb7u1, plus listed versions 1.4.12-7	1.4.12-7+deb7u1
`libgcrypt11` Debian:6.0	before 1.4.5-2+squeeze1, plus listed versions 1.4.5-2	1.4.5-2+squeeze1
`libgcrypt11` Debian:7	before 1.5.0-5+deb7u1, plus listed versions 1.5.0-5	1.5.0-5+deb7u1
`gnupg` Mageia:2	before 1.4.12-1.2.mga2	1.4.12-1.2.mga2
`libgcrypt` Mageia:2	before 1.5.0-2.1.mga2	1.5.0-2.1.mga2
`gnupg` Mageia:3	before 1.4.14-1.mga3	1.4.14-1.mga3
`libgcrypt` Mageia:3	before 1.5.3-1.mga3	1.5.3-1.mga3
`libgcrypt` Red Hat:enterprise_linux:5::client	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt-debuginfo` Red Hat:enterprise_linux:5::client	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10

Show 23 moreShow less

Affected packages
Package	Affected	Fixed
`libgcrypt` Red Hat:enterprise_linux:5::client_workstation	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt-debuginfo` Red Hat:enterprise_linux:5::client_workstation	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt-devel` Red Hat:enterprise_linux:5::client_workstation	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt` Red Hat:enterprise_linux:5::server	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt-debuginfo` Red Hat:enterprise_linux:5::server	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt-devel` Red Hat:enterprise_linux:5::server	before 0:1.4.4-7.el5_10	0:1.4.4-7.el5_10
`libgcrypt` Red Hat:enterprise_linux:6::client	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-devel` Red Hat:enterprise_linux:6::client	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt` Red Hat:enterprise_linux:6::computenode	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-devel` Red Hat:enterprise_linux:6::computenode	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt` Red Hat:enterprise_linux:6::server	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-devel` Red Hat:enterprise_linux:6::server	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt` Red Hat:enterprise_linux:6::workstation	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`libgcrypt-devel` Red Hat:enterprise_linux:6::workstation	before 0:1.4.5-11.el6_4	0:1.4.5-11.el6_4
`gnupg` Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs	before 0:1.4.5-18.el5_10	0:1.4.5-18.el5_10
`gnupg-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs	before 0:1.4.5-18.el5_10	0:1.4.5-18.el5_10
`gnupg` Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs	before 0:1.4.5-18.el5_10	0:1.4.5-18.el5_10
`gnupg-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs	before 0:1.4.5-18.el5_10	0:1.4.5-18.el5_10
`libgcrypt` openSUSE:Tumbleweed From an advisory covering 6 CVEs	before 1.7.3-1.3	1.7.3-1.3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4242 is a low vulnerability (CVSS 1.9) in Gnupg, published July 29, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in gnupg 1.4.10-4+squeeze2.

References

Show 42 moreShow less