{"id":"CVE-2018-6829","aliases":["DEBIAN-CVE-2018-6829","EUVD-2018-18576","GHSA-wcf7-2f92-j5mv","ROOT-OS-DEBIAN-12-CVE-2018-6829"],"status":"published","title":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly...","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01777,"percentile":0.78373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2018-02-07T23:00:00Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Root:Debian:12","package":"libgcrypt20","fixed_in":["1.10.1-3.root.io.2","1.10.1-3.root.io.3","1.10.1-3.root.io.4","1.10.1-3+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","fixed_in":["1.10.1-3.root.io.2","1.10.1-3.root.io.3","1.10.1-3.root.io.4","1.10.1-3+deb12u1.aikido.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-1.1","1.4.23-2","1.4.23-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3"]},{"source":"osv","ecosystem":"Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-3","1.10.1-3+deb12u1","1.10.2-1","1.10.2-2","1.10.2-2+loong64","1.10.2-3","1.10.3-1","1.10.3-2","1.10.3-3","1.11.0+git20250114-1","1.11.0-1","1.11.0-2","1.11.0-3","1.11.0-4","1.11.0-5","1.11.0-6","1.11.0-7","1.11.0~beta450-1","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.0-7+deb13u1","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.root.io.2"},{"fixed":"1.10.1-3.root.io.3"},{"fixed":"1.10.1-3.root.io.4"},{"fixed":"1.10.1-3+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.root.io.2"},{"fixed":"1.10.1-3.root.io.3"},{"fixed":"1.10.1-3.root.io.4"},{"fixed":"1.10.1-3+deb12u1.aikido.5"}]}]}],"products":[{"vendor":"gnupg","product":"libgcrypt"}],"references":[{"url":"https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/weikengchen/attack-on-libgcrypt-elgamal","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6829"},{"url":"https://github.com/advisories/GHSA-wcf7-2f92-j5mv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6829","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-6829","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2018-02-07T23:00:00Z","modified":"2024-08-05T06:17:15.803Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18576","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2018-02-07T23:00:00Z","modified":"2024-08-05T06:17:15Z","updated_at":"2026-11-03T02:40:07.110514Z"}],"ghsa":[{"id":"GHSA-wcf7-2f92-j5mv","title":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly...","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2022-05-13T01:28:55Z","modified":"2023-02-01T05:08:05Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:50:40.636216Z"}],"nvd":[{"id":"CVE-2018-6829","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2018-02-07T23:29:01.703Z","modified":"2026-06-17T02:02:19.757Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-6829","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2018-02-07T23:29:01.703Z","modified":"2026-10-24T10:30:50.872578442Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6829","description":"cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.","status":"published","published":"2018-02-07T23:29:01.703Z","modified":"2026-10-23T18:03:24.626905692Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2018-6829","title":"CVE-2018-6829 in libgcrypt20 - Patched by Root","description":"Root has patched CVE-2018-6829 in the libgcrypt20 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-27T12:40:55Z","modified":"2026-08-27T13:45:02.727340562Z","updated_at":"2026-11-02T15:53:30.44348Z"}]}}