{"id":"CVE-2019-13627","aliases":["ALPINE-CVE-2019-13627","AZL-41066","BELL-CVE-2019-13627","DEBIAN-CVE-2019-13627","DLA-1931-1","DLA-1931-2","EUVD-2019-5059","GHSA-vwvj-6vw9-cw8w","MGASA-2019-0256","RHSA-2020:4482","RLSA-2020:4482","SUSE-SU-2019:2349-1","SUSE-SU-2019:2510-1","SUSE-SU-2019:3392-1","UBUNTU-CVE-2019-13627","USN-4236-1","USN-4236-2","USN-4236-3","openSUSE-SU-2019:2161-1","openSUSE-SU-2020:0022-1","openSUSE-SU-2024:10941-1"],"status":"published","title":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library....","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00545,"percentile":0.46184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-362"],"published":"2019-09-06T21:09:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libgcrypt","fixed_in":["1.8.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"grub2","fixed_in":["2.06-25"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgcrypt20","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgcrypt20","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgcrypt20","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libgcrypt20","fixed_in":["1.6.3-2+deb8u6","1.6.3-2+deb8u8"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libgcrypt","fixed_in":["1.8.5-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libgcrypt","fixed_in":["0:1.8.5-4.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libgcrypt","fixed_in":["1.8.2-6.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"libgcrypt","fixed_in":["1.6.1-16.68.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libgcrypt","fixed_in":["1.8.2-8.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgcrypt11","fixed_in":["1.5.3-2ubuntu4.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libgcrypt20","fixed_in":["1.6.5-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","fixed_in":["1.8.1-4ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"libgcrypt","fixed_in":["1.8.2-lp150.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"libgcrypt","fixed_in":["1.8.2-lp151.9.7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.06-25"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-2+deb8u6"}]}],"versions":["1.6.3-2","1.6.3-2+deb8u1","1.6.3-2+deb8u2","1.6.3-2+deb8u3","1.6.3-2+deb8u4","1.6.3-2+deb8u5"]},{"source":"osv","ecosystem":"Debian:8","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-2+deb8u8"}]}],"versions":["1.6.3-2","1.6.3-2+deb8u1","1.6.3-2+deb8u2","1.6.3-2+deb8u3","1.6.3-2+deb8u4","1.6.3-2+deb8u5","1.6.3-2+deb8u6","1.6.3-2+deb8u7"]},{"source":"osv","ecosystem":"Mageia:7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-6.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.68.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-8.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgcrypt11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2ubuntu4.6+esm1"}]}],"versions":["1.5.0-3ubuntu3","1.5.3-2ubuntu1","1.5.3-2ubuntu4","1.5.3-2ubuntu4.1","1.5.3-2ubuntu4.2","1.5.3-2ubuntu4.3","1.5.3-2ubuntu4.4","1.5.3-2ubuntu4.5","1.5.3-2ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-2ubuntu0.6"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu1.2"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu1.2"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-2ubuntu0.6"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgcrypt11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2ubuntu4.6+esm1"}]}],"versions":["1.5.0-3ubuntu3","1.5.3-2ubuntu1","1.5.3-2ubuntu4","1.5.3-2ubuntu4.1","1.5.3-2ubuntu4.2","1.5.3-2ubuntu4.3","1.5.3-2ubuntu4.4","1.5.3-2ubuntu4.5","1.5.3-2ubuntu4.6"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-lp150.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-lp151.9.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-1.2"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"libgcrypt20_project","product":"libgcrypt20"},{"vendor":"opensuse","product":"leap"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13627","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/02/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://minerva.crocs.fi.muni.cz/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4236-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4236-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4236-3/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13627","tags":["web","advisory"]},{"url":"https://minerva.crocs.fi.muni.cz"},{"url":"https://usn.ubuntu.com/4236-1"},{"url":"https://usn.ubuntu.com/4236-2"},{"url":"https://usn.ubuntu.com/4236-3"},{"url":"https://github.com/advisories/GHSA-vwvj-6vw9-cw8w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13627","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-13627","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0256.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25399","tags":["report"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000440.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4482","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764018","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4482.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-13627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13627","tags":["advisory","report"]},{"url":"https://dev.gnupg.org/T4683","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4482","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192349-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1148987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13627","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192510-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193392-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1155338","tags":["report"]},{"url":"https://bugzilla.suse.com/1155339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13627","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4236-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4236-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4236-3","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PKEH3P7TVC5IAA2TW5RAKELX7XH72VVI/#PKEH3P7TVC5IAA2TW5RAKELX7XH72VVI","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZFVVPKWUEKAT3WOCFQNAILE4UXBMBFT3/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33560","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T14:44:45Z","modified":"2026-10-14T06:50:06.79Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-5059","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T14:44:45Z","modified":"2026-10-14T06:50:06Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-vwvj-6vw9-cw8w","title":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library....","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2022-05-24T16:56:44Z","modified":"2026-10-14T09:31:24Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-203","CWE-362"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:11.877Z","modified":"2026-10-14T07:16:46.647Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"ALPINE-CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:11.877Z","modified":"2026-09-21T06:17:52.482285044Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-41066","title":"CVE-2019-13627 affecting package grub2 for versions less than 2.06-25","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:11Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"BELL-CVE-2019-13627","title":"CVE-2019-13627 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:34.133359Z","modified":"2026-09-04T07:15:22.900549996Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:11.877Z","modified":"2026-10-20T10:50:42.323577356Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:11.877Z","modified":"2026-10-15T07:47:34.466585197Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"RHSA-2020:4482","title":"Red Hat Security Advisory: libgcrypt security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:05:58Z","modified":"2026-10-14T10:01:33Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4482","title":"Moderate: libgcrypt security, bug fix, and enhancement update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nThe following packages have been upgraded to a later upstream version: libgcrypt (1.8.5). (BZ#1764918)\n\nSecurity Fix(es):\n\n* libgcrypt: ECDSA timing attack allowing private key leak (CVE-2019-13627)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:08:44Z","modified":"2026-02-05T11:00:03.87002Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-13627","description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","status":"published","published":"2019-09-25T15:15:00Z","modified":"2026-04-22T12:10:17.061794Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1931-1","title":"libgcrypt20 - security update","status":"published","published":"2019-09-24T00:00:00Z","modified":"2026-03-09T01:18:54.698973Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-1931-2","title":"libgcrypt20 - regression update","status":"published","published":"2020-01-01T00:00:00Z","modified":"2026-03-09T01:20:54.782009Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0256","title":"Updated libgcrypt packages fix security vulnerability","description":"Updated libgcrypt packages fix security vulnerability:\n\nECDSA timing side-channel attack vulnerability (CVE-2019-13627).\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:40:57.707903628Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2161-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-24T08:16:21Z","modified":"2026-02-04T04:12:28.115801Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2020:0022-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987).\n\nBug fixes:\n\n- Added CMAC AES self test (bsc#1155339).\n- Added CMAC TDES self test missing (bsc#1155338).\n- Fix test dsa-rfc6979 in FIPS mode.\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-01-13T15:18:14Z","modified":"2026-02-04T02:46:02.303693Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10941-1","title":"libgcrypt-cavs-1.9.4-1.2 on GA media","description":"These are all security issues fixed in the libgcrypt-cavs-1.9.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:35:52.263076Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2349-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)\n","status":"published","published":"2019-09-10T12:52:13Z","modified":"2026-02-04T03:50:15.617671Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2510-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-13627: Mitigated ECDSA timing attack. (bsc#1148987)\n","status":"published","published":"2019-10-01T15:37:53Z","modified":"2026-02-04T04:19:17.617504Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:3392-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-13627: Mitigation against an ECDSA timing attack (bsc#1148987).\n\nBug fixes:\n\n- Added CMAC AES self test (bsc#1155339).\n- Added CMAC TDES self test missing (bsc#1155338).\n- Fix test dsa-rfc6979 in FIPS mode.\n","status":"published","published":"2019-12-27T12:33:32Z","modified":"2026-02-04T02:49:45.501207Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4236-1","title":"libgcrypt20 vulnerability","description":"It was discovered that Libgcrypt was susceptible to a ECDSA timing attack.\nAn attacker could possibly use this attack to recover sensitive\ninformation.\n","status":"published","published":"2020-01-13T15:36:56Z","modified":"2026-04-22T09:51:04.193002Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4236-2","title":"libgcrypt20 vulnerability","description":"USN-4236-1 fixed a vulnerability in Libgcrypt. This update provides the\ncorresponding fix for Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Libgcrypt was susceptible to a ECDSA timing attack.\n An attacker could possibly use this attack to recover sensitive\n information.\n","status":"published","published":"2020-01-14T13:00:37Z","modified":"2026-04-22T10:01:56.227928Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4236-3","title":"libgcrypt11 vulnerability","description":"USN-4236-1 fixed a vulnerability in Libgcrypt. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Libgcrypt was susceptible to a ECDSA timing attack.\n An attacker could possibly use this attack to recover sensitive\n information.\n","status":"published","published":"2020-01-28T16:52:42Z","modified":"2026-04-22T10:02:01.648424Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}