{"id":"CVE-2024-2236","aliases":["ALSA-2024:9404","AZL-108024","BELL-CVE-2024-2236","CLSA-2025-1736859209","CLSA-2025-1737656427","CLSA-2025-1744301726","CLSA-2025-1751538844","DEBIAN-CVE-2024-2236","EUVD-2024-27192","GHSA-w2gx-4fh8-wm9f","MGASA-2026-0464","RHSA-2024:9404","RHSA-2025:3530","RHSA-2025:3534","RLSA-2024:9404","ROOT-OS-DEBIAN-12-CVE-2024-2236","ROOT-OS-UBUNTU-2204-CVE-2024-2236","SUSE-FU-2026:21213-1","SUSE-FU-2026:21232-1","SUSE-SU-2025:02447-1","SUSE-SU-2025:02464-1","SUSE-SU-2025:02464-2","SUSE-SU-2025:02719-1","SUSE-SU-2025:02752-1","SUSE-SU-2025:02756-1","SUSE-SU-2025:02773-1","SUSE-SU-2025:20490-1","SUSE-SU-2025:20538-1","UBUNTU-CVE-2024-2236","USN-8711-1","openSUSE-FU-2026:20562-1","openSUSE-SU-2025:15239-1"],"status":"published","title":"Libgcrypt: vulnerable to marvin attack","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0114,"percentile":0.66843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208","CWE-385"],"published":"2024-03-06T22:07:16Z","modified":"2026-11-05T12:01:31Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"libgcrypt","fixed_in":["1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libgcrypt-devel","fixed_in":["1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","fixed_in":["1.10.0-10.el9_2.tuxcare.els1","1.10.0-11.el9_2.tuxcare.1","1.10.0-11.el9.tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","fixed_in":["1.10.0-10.el9_2.tuxcare.els1","1.10.0-11.el9_2.tuxcare.1","1.10.0-11.el9.tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt","fixed_in":["1.10.0-11.el9_2.tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt-devel","fixed_in":["1.10.0-11.el9_2.tuxcare.1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libgcrypt","fixed_in":["1.11.3-1.1.mga10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-devel","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-10.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-devel","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-10.el9_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libgcrypt","fixed_in":["0:1.10.0-11.el9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libgcrypt20","fixed_in":["1.10.1-3.root.io.1","1.10.1-3.root.io.2","1.10.1-3.root.io.3","1.10.1-3.root.io.4","1.10.1-3+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","fixed_in":["1.10.1-3.root.io.1","1.10.1-3.root.io.2","1.10.1-3.root.io.3","1.10.1-3.root.io.4","1.10.1-3+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgpg-error","fixed_in":["1.58-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgpg-error","fixed_in":["1.58-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","fixed_in":["1.12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libgpg-error","fixed_in":["1.58-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libgcrypt","fixed_in":["1.10.3-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libgcrypt","fixed_in":["1.10.3-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"libgcrypt","fixed_in":["1.9.4-150400.6.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libgcrypt","fixed_in":["1.11.0-150700.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"libgcrypt","fixed_in":["1.8.2-150100.8.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libgcrypt","fixed_in":["1.6.1-16.86.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libgcrypt","fixed_in":["1.6.1-16.86.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libgcrypt","fixed_in":["1.9.4-150500.12.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libgcrypt","fixed_in":["1.9.4-150500.12.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libgcrypt","fixed_in":["1.9.4-150500.12.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libgcrypt","fixed_in":["1.9.4-150500.12.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libgcrypt","fixed_in":["1.9.4-150500.12.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libgcrypt","fixed_in":["1.10.3-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libgcrypt","fixed_in":["1.10.3-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","fixed_in":["1.9.4-3ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"libgcrypt20","fixed_in":["1.9.4-3ubuntu3.3+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","fixed_in":["1.10.3-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu1.1+Fips2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libgpg-error","fixed_in":["1.58-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libgcrypt","fixed_in":["1.11.1-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-10.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-10.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_2.tuxcare.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_2.tuxcare.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9.tuxcare.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9.tuxcare.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_2.tuxcare.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_2.tuxcare.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-3","1.10.1-3+deb12u1","1.10.2-1","1.10.2-2","1.10.2-2+loong64","1.10.2-3","1.10.3-1","1.10.3-2","1.10.3-3","1.11.0+git20250114-1","1.11.0-1","1.11.0-2","1.11.0-3","1.11.0-4","1.11.0-5","1.11.0-6","1.11.0-7","1.11.0~beta450-1","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.0-7+deb13u1","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2","1.12.2-1","1.12.3-1","1.12.3-2","1.12.4-1","1.12.4-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.root.io.1"},{"fixed":"1.10.1-3.root.io.2"},{"fixed":"1.10.1-3.root.io.3"},{"fixed":"1.10.1-3.root.io.4"},{"fixed":"1.10.1-3+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.root.io.1"},{"fixed":"1.10.1-3.root.io.2"},{"fixed":"1.10.1-3.root.io.3"},{"fixed":"1.10.1-3.root.io.4"},{"fixed":"1.10.1-3+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgpg-error","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgpg-error","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libgpg-error","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150700.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-150100.8.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.86.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.86.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgcrypt11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0-3ubuntu3","1.5.3-2ubuntu1","1.5.3-2ubuntu4","1.5.3-2ubuntu4.1","1.5.3-2ubuntu4.2","1.5.3-2ubuntu4.3","1.5.3-2ubuntu4.4","1.5.3-2ubuntu4.5","1.5.3-2ubuntu4.6","1.5.3-2ubuntu4.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5","1.6.5-2ubuntu0.6","1.6.5-2ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1","1.8.1-4ubuntu1.2","1.8.1-4ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5","1.8.1-4ubuntu1.fips.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4-5ubuntu2","1.8.5-3ubuntu1","1.8.5-5ubuntu1","1.8.5-5ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-5ubuntu1.fips.1.1","1.8.5-5ubuntu1.fips.1.4","1.8.5-5ubuntu1.fips.1.5","1.8.5-5ubuntu1.fips.1.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-5ubuntu1.fips.1.1","1.8.5-5ubuntu1.fips.1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.3"}]}],"versions":["1.8.7-5ubuntu2","1.9.4-3ubuntu2","1.9.4-3ubuntu3","1.9.4-3ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-3ubuntu3+Fips1.1","1.9.4-3ubuntu3+Fips1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.3+Fips1"}]}],"versions":["1.9.4-3ubuntu3+Fips1.1","1.9.4-3ubuntu3+Fips1.2","1.9.4-3ubuntu3+Fips1.3","1.9.4-3ubuntu3+Fips1.4","1.9.4-3ubuntu3.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2ubuntu0.2"}]}],"versions":["1.10.2-3ubuntu1","1.10.3-2","1.10.3-2build1","1.10.3-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu1.1+Fips2"}]}],"versions":["1.10.3-2ubuntu0.1~Fips1~rc6","1.10.3-2ubuntu0.1~Fips1~rc7","1.12.0-2ubuntu0.1~Fips1~rc11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-6ubuntu1","1.11.0-7","1.11.0-7build1","1.11.0-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu1.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2","1.12.0-2ubuntu0.1","1.12.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.3"}]}],"versions":["1.8.7-5ubuntu2","1.9.4-3ubuntu2","1.9.4-3ubuntu3","1.9.4-3ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2ubuntu0.2"}]}],"versions":["1.10.2-3ubuntu1","1.10.3-2","1.10.3-2build1","1.10.3-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu1.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2","1.12.0-2ubuntu0.1","1.12.0-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libgpg-error","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:9404","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3530","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3534","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2236","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245218","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268268","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2236","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w2gx-4fh8-wm9f"},{"url":"https://bugzilla.redhat.com/2245218","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9404.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-2236","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1736859209.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-fips/CLSA-2025-1737656427.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1744301726.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2fips/CLSA-2025-1751538844.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2236","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0464.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36248","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8711-1","tags":["advisory"]},{"url":"https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html","tags":["web","report"]},{"url":"https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt","tags":["web","report"]},{"url":"https://people.redhat.com/~hkario/marvin/","tags":["web"]},{"url":"https://dev.gnupg.org/T7136","tags":["web","report"]},{"url":"https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17","tags":["web","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9404.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2236","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3530.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3534.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9404","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-fu-202621213-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2236","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement//suse-fu-202621232-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502447-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221107","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502464-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502464-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502719-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246934","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502752-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502756-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502773-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520490-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520538-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-2236","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2236","title":"Libgcrypt: vulnerable to marvin attack","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:07:16.617Z","modified":"2026-11-05T12:01:31.408Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-385"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-27192","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:07:16Z","modified":"2026-11-05T12:01:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-w2gx-4fh8-wm9f","title":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may...","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-07T00:30:49Z","modified":"2026-10-15T03:33:14Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-208","CWE-385"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:15:57.977Z","modified":"2026-11-05T12:17:48.827Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-385"],"updated_at":"2026-11-05T16:36:40.983114Z"}],"osv":[{"id":"BELL-CVE-2024-2236","status":"published","published":"2024-03-07T05:56:39.186719Z","modified":"2026-09-04T07:15:17.658712252Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"DEBIAN-CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:15:57.977Z","modified":"2026-11-02T12:00:44.246766907Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"RHSA-2024:9404","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2024-11-12T18:06:12Z","modified":"2026-10-14T10:05:48Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:3530","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2025-04-03T10:07:01Z","modified":"2026-10-14T10:10:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3534","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2025-04-03T10:07:03Z","modified":"2026-10-14T10:10:05Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2024:9404","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nSecurity Fix(es):\n\n* libgcrypt: vulnerable to Marvin Attack (CVE-2024-2236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:43.608626Z","modified":"2025-10-09T06:18:55.21723Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:15:00Z","modified":"2026-09-25T17:45:09.209245018Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:9404","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.  \n\nSecurity Fix(es):  \n\n  * libgcrypt: vulnerable to Marvin Attack (CVE-2024-2236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:54.525737946Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-108024","title":"CVE-2024-2236 affecting package libgcrypt 1.11.3-1","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:15:57Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"CLSA-2025-1736859209","title":"libgcrypt: Fix of CVE-2024-2236","description":"- CVE-2024-2236: fix timing-based side-channel vulnerability in RSA\n  implementation","status":"published","published":"2025-01-14T13:07:32Z","modified":"2026-06-01T00:30:22.788037957Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1737656427","title":"libgcrypt: Fix of CVE-2024-2236","description":"- Synced to upstream plus ASN.1 patch\n- Tested on AlmaLinux 9.5\n- Fix CVE-2024-2236 (RHEL-34579)","status":"published","published":"2025-04-11T08:20:55Z","modified":"2026-06-01T00:30:33.50290563Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1744301726","title":"libgcrypt: Fix of CVE-2024-2236","description":"- Synced to upstream plus ASN.1 patch\n- Tested on AlmaLinux 9.5\n- Fix CVE-2024-2236 (RHEL-34579)","status":"published","published":"2025-04-10T16:20:21Z","modified":"2026-06-01T00:30:35.893684466Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1751538844","title":"libgcrypt: Fix of CVE-2024-2236","description":"- Synced to upstream plus ASN.1 patch\n- Tested on AlmaLinux 9.5\n- Fix CVE-2024-2236 (RHEL-34579)","status":"published","published":"2025-07-03T10:38:04Z","modified":"2026-06-01T00:32:35.050324495Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.","status":"published","published":"2024-03-06T22:15:57Z","modified":"2026-04-23T18:44:15.505719978Z","updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"MGASA-2026-0464","title":"Updated libgcrypt package fixes a security vulnerability","description":"Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236)\n","status":"published","published":"2026-10-02T06:40:06Z","modified":"2026-10-02T06:45:03.309795621Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-FU-2026:20562-1","title":"Feature update for libgcrypt, libgpg-error","description":"This update for libgcrypt, libgpg-error fixes the following issues:\n\nUpdate libgcrypt to 1.12.1 (jsc#PED-15059):\n\n* New and extended interfaces:\n - Allow access to the FIPS service indicator via the new\n GCRYCTL_FIPS_SERVICE_INDICATOR control code.\n - Make SHA-1 non-FIPS internally for the 1.12 API\n - Add Dilithium (ML-DSA) support\n - Support optional random-override and support byte string data\n\n* Bug fixes:\n - Use secure MPI in _gcry_mpi_assign_limb_space.\n - Use CSIDL_COMMON_APPDATA instead of /etc on Windows.\n - Apply a Kyber patch from upstream.\n - Fix an edge case in Jent initialization.\n - mceliece6688128f: Fix stack overflow crash on win64/wine\n * Performance:\n - Many performance improvements, new AVX512 implementations for modern CPUs.\n - Add RISC-V Zbb+Zbc implementation of CRC.\n - Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512\n - Add AVX2 and AVX512 code paths to improve CRC.\n\nFor a full changelog, see:\nhttps://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0\n\nUpdate libgpg-error to 1.58:\n\n * New src/gpg-error.c (main): New command \"fconcat\".\n * Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to\n ENVP.\n * argparse: Use SYSCONFDIR for /etc.\n * Update translations for Portugese, German\n * src/estream.c (parse_mode): Fix parsing of \"share\". Set sysopen\n flag.\n * syscfg: Add 64-bit Android arch.\n","status":"published","published":"2026-04-17T10:37:59Z","modified":"2026-04-22T18:25:31.235033Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2025:15239-1","title":"libgcrypt-devel-1.11.1-2.1 on GA media","description":"These are all security issues fixed in the libgcrypt-devel-1.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.554365Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-2236","title":"CVE-2024-2236 in libgcrypt20 - Patched by Root","description":"Root has patched CVE-2024-2236 in the libgcrypt20 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-27T12:40:55Z","modified":"2026-08-27T13:45:04.286717171Z","updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2024-2236","title":"CVE-2024-2236 in libgcrypt20 - Patched by Root","description":"Root has patched CVE-2024-2236 in the libgcrypt20 package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-11T16:36:57Z","modified":"2026-10-09T13:00:18.342376895Z","updated_at":"2026-11-02T15:53:34.203982Z"},{"id":"SUSE-FU-2026:21213-1","title":"Feature update for libgcrypt, libgpg-error","description":"This update for libgcrypt, libgpg-error fixes the following issues:\n\nUpdate libgcrypt to 1.12.1 (jsc#PED-15059):\n\n* New and extended interfaces:\n - Allow access to the FIPS service indicator via the new\n GCRYCTL_FIPS_SERVICE_INDICATOR control code.\n - Make SHA-1 non-FIPS internally for the 1.12 API\n - Add Dilithium (ML-DSA) support\n - Support optional random-override and support byte string data\n\n* Bug fixes:\n - Use secure MPI in _gcry_mpi_assign_limb_space.\n - Use CSIDL_COMMON_APPDATA instead of /etc on Windows.\n - Apply a Kyber patch from upstream.\n - Fix an edge case in Jent initialization.\n - mceliece6688128f: Fix stack overflow crash on win64/wine\n * Performance:\n - Many performance improvements, new AVX512 implementations for modern CPUs.\n - Add RISC-V Zbb+Zbc implementation of CRC.\n - Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512\n - Add AVX2 and AVX512 code paths to improve CRC.\n\nFor a full changelog, see:\nhttps://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0\n\nUpdate libgpg-error to 1.58:\n\n * New src/gpg-error.c (main): New command \"fconcat\".\n * Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to\n ENVP.\n * argparse: Use SYSCONFDIR for /etc.\n * Update translations for Portugese, German\n * src/estream.c (parse_mode): Fix parsing of \"share\". Set sysopen\n flag.\n * syscfg: Add 64-bit Android arch.\n","status":"published","published":"2026-04-17T10:34:15Z","modified":"2026-04-22T18:23:42.999381Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-FU-2026:21232-1","title":"Feature update for libgcrypt, libgpg-error","description":"This update for libgcrypt, libgpg-error fixes the following issues:\n\nUpdate libgcrypt to 1.12.1 (jsc#PED-15059):\n\n* New and extended interfaces:\n - Allow access to the FIPS service indicator via the new\n GCRYCTL_FIPS_SERVICE_INDICATOR control code.\n - Make SHA-1 non-FIPS internally for the 1.12 API\n - Add Dilithium (ML-DSA) support\n - Support optional random-override and support byte string data\n\n* Bug fixes:\n - Use secure MPI in _gcry_mpi_assign_limb_space.\n - Use CSIDL_COMMON_APPDATA instead of /etc on Windows.\n - Apply a Kyber patch from upstream.\n - Fix an edge case in Jent initialization.\n - mceliece6688128f: Fix stack overflow crash on win64/wine\n * Performance:\n - Many performance improvements, new AVX512 implementations for modern CPUs.\n - Add RISC-V Zbb+Zbc implementation of CRC.\n - Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512\n - Add AVX2 and AVX512 code paths to improve CRC.\n\nFor a full changelog, see:\nhttps://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0\n\nUpdate libgpg-error to 1.58:\n\n * New src/gpg-error.c (main): New command \"fconcat\".\n * Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to\n ENVP.\n * argparse: Use SYSCONFDIR for /etc.\n * Update translations for Portugese, German\n * src/estream.c (parse_mode): Fix parsing of \"share\". Set sysopen\n flag.\n * syscfg: Add 64-bit Android arch.\n","status":"published","published":"2026-04-17T10:34:15Z","modified":"2026-04-23T18:26:44.524499Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:02447-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: Fixed timing based side-channel in RSA implementation. (bsc#1221107)\n","status":"published","published":"2025-07-21T14:45:26Z","modified":"2026-02-04T03:21:13.788323Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02464-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).  \n","status":"published","published":"2025-07-22T11:40:21Z","modified":"2026-03-23T04:46:37.212984Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02464-2","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).  \n","status":"published","published":"2025-08-01T09:17:59Z","modified":"2026-02-04T03:23:46.431092Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02719-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).\n","status":"published","published":"2025-08-07T03:38:36Z","modified":"2026-02-04T03:08:50.699614Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02752-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).\n","status":"published","published":"2025-08-11T13:15:24Z","modified":"2026-03-23T04:48:38.522697Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02756-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).\n","status":"published","published":"2025-08-12T08:23:08Z","modified":"2026-02-04T03:57:27.204137Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02773-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts (bsc#1221107).\n","status":"published","published":"2025-08-13T00:10:27Z","modified":"2026-02-04T02:45:53.977505Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20490-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: Fixed timing based side-channel in RSA implementation (bsc#1221107)\n","status":"published","published":"2025-07-11T09:20:30Z","modified":"2026-03-23T04:48:58.243816Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20538-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issues:\n\n- CVE-2024-2236: Fixed timing based side-channel in RSA implementation (bsc#1221107)\n","status":"published","published":"2025-07-31T09:38:25Z","modified":"2026-03-23T04:50:11.396929Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-8711-1","title":"libgcrypt20 vulnerability","description":"It was discovered that Libgcrypt had a timing-based side-channel flaw in\nits RSA implementation. A remote attacker could possibly use this issue to\nobtain sensitive information.","status":"published","published":"2026-09-01T16:14:15Z","modified":"2026-09-02T02:41:28.743706358Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}