CVE-2017-0379

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it...

7.5 HighFix available

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

3.51%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: CVE-2017-0379
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: CVE-2017-0379
Updated: 2026-11-02

EUVDEUVD-2017-0733 No score

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: EUVD-2017-0733
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j848-fx94-98m4 7.5

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it...

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: GHSA-j848-fx94-98m4
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVALPINE-CVE-2017-0379 7.5

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: ALPINE-CVE-2017-0379
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV 7.5

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: CVE-2017-0379
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-0379 7.5

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.

Record: DEBIAN-CVE-2017-0379
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2017-0334 No score

Updated libgcrypt packages fix security vulnerability

It was discovered that libgcrypt is prone to a local side-channel attack against the ECDH encryption with Curve25519, allowing recovery of the private key.

Record: MGASA-2017-0334
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10941-1 No score

libgcrypt-cavs-1.9.4-1.2 on GA media

These are all security issues fixed in the libgcrypt-cavs-1.9.4-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10941-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libgcrypt` Alpine:v3.4	before 1.7.9-r0	1.7.9-r0
`libgcrypt` Alpine:v3.5	before 1.7.9-r0	1.7.9-r0
`libgcrypt` Alpine:v3.6	before 1.7.9-r0	1.7.9-r0
`libgcrypt20` Debian:12	before 1.7.9-1	1.7.9-1
`libgcrypt20` Debian:13	before 1.7.9-1	1.7.9-1
`libgcrypt20` Debian:14	before 1.7.9-1	1.7.9-1
`libgcrypt20` Debian:9	before 1.7.6-2+deb9u2, plus listed versions 1.7.6-21.7.6-2+deb9u1	1.7.6-2+deb9u2
`libgcrypt` Mageia:6	before 1.7.8-1.1.mga6	1.7.8-1.1.mga6
`libgcrypt` openSUSE:Tumbleweed From an advisory covering 7 CVEs	before 1.9.4-1.2	1.9.4-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-0379 is a high vulnerability (CVSS 7.5) in Gnupg Libgcrypt, published August 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.51%, the 89th percentile. Fixed in libgcrypt 1.7.9-r0.

References

Show 18 moreShow less