CVE-2016-6313

Опубликовано: 13 дек. 2016

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

Ссылки

http://rhn.redhat.com/errata/RHSA-2016-2674.html
http://www.debian.org/security/2016/dsa-3649
Third Party Advisory
http://www.debian.org/security/2016/dsa-3650
Third Party Advisory
http://www.securityfocus.com/bid/92527
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036635
http://www.ubuntu.com/usn/USN-3064-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-3065-1
Third Party Advisory
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
Mailing List
Vendor Advisory
https://security.gentoo.org/glsa/201610-04
https://security.gentoo.org/glsa/201612-01
http://rhn.redhat.com/errata/RHSA-2016-2674.html
http://www.debian.org/security/2016/dsa-3649
Third Party Advisory
http://www.debian.org/security/2016/dsa-3650
Third Party Advisory
http://www.securityfocus.com/bid/92527
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036635
http://www.ubuntu.com/usn/USN-3064-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-3065-1
Third Party Advisory
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS
https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
Mailing List
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*

Версия до 1.5.3 (включая)

cpe:2.3:a:gnupg:libgcrypt:1.6.0:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.6.2:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.6.3:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.6.4:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.6.5:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:gnupg:libgcrypt:1.7.2:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Конфигурация 4

cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*

Версия до 1.4.14 (включая)

EPSS

Процентиль: 84%

0.02168

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2016-6313

CVSS3: 5.3

ubuntu

больше 8 лет назад

CVE-2016-6313

CVSS3: 4.8

redhat

около 9 лет назад

CVE-2016-6313

CVSS3: 5.3

debian

больше 8 лет назад

The mixing functions in the random number generator in Libgcrypt befor ...

openSUSE-SU-2016:2423-1

suse-cvrf

почти 9 лет назад

Security update for libgcrypt

SUSE-SU-2016:2346-1

suse-cvrf

почти 9 лет назад

Security update for libgcrypt

EPSS

Процентиль: 84%

0.02168

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200