{"id":"CVE-2021-40528","aliases":["ALPINE-CVE-2021-40528","ALSA-2022:5311","BELL-CVE-2021-40528","CLSA-2023-1698945053","CLSA-2026-1782731604","DEBIAN-CVE-2021-40528","DLA-2691-1","EUVD-2021-27703","GHSA-8m2v-68m9-q2c7","JLSEC-2026-124","MGASA-2021-0446","OESA-2021-1362","RHSA-2022:5311","RLSA-2022:5311","UBUNTU-CVE-2021-40528","USN-5080-1","USN-5080-2","openSUSE-SU-2024:12540-1"],"status":"published","title":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during...","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01423,"percentile":0.73101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2021-06-25T00:00:00Z","modified":"2026-10-29T11:01:05Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"libgcrypt","fixed_in":["1.8.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libgcrypt","fixed_in":["1.8.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libgcrypt","fixed_in":["1.8.8-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgcrypt","fixed_in":["1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgcrypt-devel","fixed_in":["1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgcrypt20","fixed_in":["1.8.7-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgcrypt20","fixed_in":["1.8.7-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgcrypt20","fixed_in":["1.8.7-6"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libgcrypt20","fixed_in":["1.7.6-2+deb9u4"],"sources":["osv"]},{"ecosystem":"Julia","package":"Libgcrypt_jll","fixed_in":["1.11.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libgcrypt","fixed_in":["1.8.7-1.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libgcrypt","fixed_in":["1.8.6-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"libgcrypt","fixed_in":["1.8.6-4.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgcrypt20","fixed_in":["1.6.5-2ubuntu0.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","fixed_in":["1.8.1-4ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"libgcrypt20","fixed_in":["1.8.1-4ubuntu1.fips.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libgcrypt20","fixed_in":["1.8.5-5ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"libgcrypt20","fixed_in":["1.8.5-5ubuntu1.fips.1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"libgcrypt20","fixed_in":["1.8.5-5ubuntu1.fips.1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","fixed_in":["1.8.7-5ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libgcrypt","fixed_in":["1.10.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el7.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-6"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6-2+deb9u4"}]}],"versions":["1.7.6-2","1.7.6-2+deb9u1","1.7.6-2+deb9u2","1.7.6-2+deb9u3"]},{"source":"osv","ecosystem":"Julia","package":"Libgcrypt_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.6-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.6-4.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-2ubuntu0.6+esm1"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5","1.6.5-2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu1.3"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1","1.8.1-4ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu1.fips.3"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-5ubuntu1.1"}]}],"versions":["1.8.4-5ubuntu2","1.8.5-3ubuntu1","1.8.5-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-5ubuntu1.fips.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-5ubuntu1.fips.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-5ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu1.3"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1","1.8.1-4ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-5ubuntu1.1"}]}],"versions":["1.8.4-5ubuntu2","1.8.5-3ubuntu1","1.8.5-5ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-2ubuntu0.6+esm1"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5","1.6.5-2ubuntu0.6"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1"}]}]}],"products":[{"vendor":"gnupg","product":"libgcrypt"}],"references":[{"url":"https://eprint.iacr.org/2021/923","tags":["x_transferred","Technical Description","Third Party Advisory","advisory","web","article","report"]},{"url":"https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1","tags":["x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","article","report"]},{"url":"https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202210-13","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40528","tags":["advisory"]},{"url":"https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=3462280f2e23e16adf3ed5176e0f2413d8861320"},{"url":"https://github.com/advisories/GHSA-8m2v-68m9-q2c7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-40528","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5311","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-40528","tags":["report"]},{"url":"https://bugzilla.redhat.com/2002816","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-5311.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-40528","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos7-els/CLSA-2023-1698945053.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1782731604.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33560","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40528","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29467","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5080-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1362","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002816","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5311.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40528","tags":["advisory","report"]},{"url":"https://dev.gnupg.org/rCb118681ebc4c9ea4b9da79b0f9541405a64f4c13","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5311","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-40528","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5080-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33560","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40528","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T00:00:00Z","modified":"2025-06-09T15:13:03.906Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:33:01.495293Z"}],"euvd":[{"id":"EUVD-2021-27703","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T00:00:00Z","modified":"2025-06-09T15:13:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-8m2v-68m9-q2c7","title":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during...","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2022-05-24T19:13:02Z","modified":"2025-06-09T18:33:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:02:38.272027Z"}],"nvd":[{"id":"CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T19:15:07.587Z","modified":"2026-06-17T04:07:05.66Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:06:58.05696Z"}],"osv":[{"id":"ALPINE-CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T19:15:07.587Z","modified":"2026-10-23T17:17:56.210749993Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-40528","title":"CVE-2021-40528 does not affect BellSoft software","status":"withdrawn","published":"2021-09-06T19:15:00Z","modified":"2026-09-04T07:15:22.007172858Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T19:15:07.587Z","modified":"2026-10-24T10:30:49.46121023Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T19:15:07.587Z","modified":"2026-10-23T18:03:32.954846626Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"JLSEC-2026-124","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2026-04-17T13:07:52.234Z","modified":"2026-07-18T00:01:29.476114253Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2021-1362","title":"libgcrypt security update","description":"Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.\r\n\r\nSecurity Fix(es):\r\n\r\nThe ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver\u0026apos;s public key, the generator defined by the receiver\u0026apos;s public key, and the sender\u0026apos;s ephemeral exponents can lead to a cross-configuration attack against OpenPGP.(CVE-2021-40528)","status":"published","published":"2021-09-30T11:04:38Z","modified":"2026-08-18T01:16:02.908572852Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:5311","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2024-09-16T08:01:24Z","modified":"2025-11-22T12:35:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:5311","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nSecurity Fix(es):\n\n* libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-28T10:51:57Z","modified":"2026-02-04T11:30:10.813453Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-40528","description":"The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.","status":"published","published":"2021-09-06T19:15:00Z","modified":"2026-04-22T13:00:22.61635Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2022:5311","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\nSecurity Fix(es):\n* libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-30T00:00:00Z","modified":"2026-10-29T11:01:05.975135551Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2023-1698945053","title":"libgcrypt: Fix of 4 CVEs","description":"- CVE-2013-4576: Normalize the MPIs to prevent possible side-channel\n  attacks\n- CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent\n  possible side-channel attacks\n- CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal\n  prevent generation of weak keys\n- CVE-2021-40528: Add exponent blinding as well to mitigate\n  side-channel attack on mpi_powm\n- tests: Add a benchmark for Elgamal","status":"published","published":"2023-11-02T17:10:57Z","modified":"2026-06-01T00:33:17.284256741Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2026-1782731604","title":"libgcrypt: Fix of CVE-2021-33560","description":"- CVE-2013-4576: Normalize the MPIs to prevent possible side-channel\n  attacks\n- CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent\n  possible side-channel attacks\n- CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal\n  prevent generation of weak keys\n- CVE-2021-40528: Add exponent blinding as well to mitigate\n  side-channel attack on mpi_powm\n- tests: Add a benchmark for Elgamal","status":"published","published":"2026-06-29T11:13:40Z","modified":"2026-10-26T09:43:35.904800852Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"DLA-2691-1","title":"libgcrypt20 - security update","status":"published","published":"2021-06-25T00:00:00Z","modified":"2026-03-09T01:21:15.123194Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0446","title":"Updated libgcrypt packages fix security vulnerability","description":"The updated packages fix a security vulnerability:\n\nThe ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext\nrecovery because, during interaction between two cryptographic libraries,\na certain dangerous combination of the prime defined by the receiver's\npublic key, the generator defined by the receiver's public key, and the\nsender's ephemeral exponents can lead to a cross-configuration attack\nagainst OpenPGP (CVE-2021-40528).\n","status":"published","published":"2021-09-29T17:22:22Z","modified":"2026-04-16T04:41:00.750337122Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12540-1","title":"libgcrypt-devel-1.10.1-1.1 on GA media","description":"These are all security issues fixed in the libgcrypt-devel-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:12.926439Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-5080-1","title":"libgcrypt20 vulnerabilities","description":"It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An\nattacker could possibly use this issue to recover sensitive information.\n","status":"published","published":"2021-09-16T11:12:40Z","modified":"2026-04-27T15:56:47.190896Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5080-2","title":"libgcrypt20 vulnerabilities","description":"USN-5080-1 fixed several vulnerabilities in Libgcrypt. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An\n attacker could possibly use this issue to recover sensitive information.\n","status":"published","published":"2021-09-16T16:07:21Z","modified":"2026-06-25T13:30:48.098616828Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}