Vulnerability Name:

CVE-2019-12904 (CCN-162818)

Assigned:2019-05-31
Published:2019-05-31
Updated:2021-07-21
Summary:** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)
Note: the vendor's position is that the issue report cannot be validated because there is no description of an attack.
CVSS v3 Severity:5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
3.2 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-310
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2019-12904

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2019:1792

Source: MISC
Type: Third Party Advisory
https://dev.gnupg.org/T4541

Source: XF
Type: UNKNOWN
libgcrypt-cve201912904-info-disc(162818)

Source: CCN
Type: libgcrypt GIT Repository
GCM: move look-up table to .data section and unshare between processes

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762

Source: MLIST
Type: Mailing List, Third Party Advisory
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-12904

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnupg:libgcrypt:1.8.4:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:opensuse:leap:15.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnupg:libgcrypt:1.8.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201912904
    V
    		CVE-2019-12904
    2023-06-22
    oval:org.opensuse.security:def:7592
    P
    		libgcrypt-devel-1.9.4-150500.10.19 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51938
    P
    		Security update for multipath-tools (Important)
    2022-10-24
    oval:org.opensuse.security:def:727
    P
    		Security update for curl (Low)
    2022-09-02
    oval:org.opensuse.security:def:3238
    P
    		libprocps3-3.3.9-11.18.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3505
    P
    		gnome-shell-3.20.4-77.23.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3007
    P
    		apache-commons-beanutils-1.9.2-3.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3226
    P
    		libospf0-1.1.1-17.7.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3493
    P
    		g3utils-1.1.36-58.6.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94637
    P
    		libgcrypt-devel-1.9.4-150400.4.6 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:134
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:1350
    P
    		Security update for the Linux Kernel (Important)
    2022-05-16
    oval:org.opensuse.security:def:1560
    P
    		Security update for the Linux Kernel (Important)
    2022-01-25
    oval:org.opensuse.security:def:1063
    P
    		Security update for MozillaFirefox (Important)
    2022-01-20
    oval:org.opensuse.security:def:112636
    P
    		libgcrypt-cavs-1.9.4-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106117
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:69819
    P
    		Security update for net-snmp (Important)
    2022-01-11
    oval:org.opensuse.security:def:93783
    P
    		 (Moderate)
    2021-12-16
    oval:org.opensuse.security:def:68095
    P
    		Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP1) (Important)
    2021-12-14
    oval:org.opensuse.security:def:68752
    P
    		Security update for samba (Important)
    2021-11-10
    oval:org.opensuse.security:def:65315
    P
    		Security update for MozillaFirefox (Important)
    2021-10-16
    oval:org.opensuse.security:def:51671
    P
    		Security update for glibc (Moderate)
    2021-10-06
    oval:org.opensuse.security:def:64761
    P
    		Security update for java-11-openjdk (Important)
    2021-09-03
    oval:org.opensuse.security:def:69714
    P
    		Security update for djvulibre (Important)
    2021-08-20
    oval:org.opensuse.security:def:48078
    P
    		libXfont2-2-2.0.3-1.19 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48003
    P
    		evince-3.20.2-6.27.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48213
    P
    		libusbmuxd4-1.0.10-2.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47882
    P
    		ruby-2.1-1.4 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48328
    P
    		u-boot-rpi3-2019.01-3.7 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47867
    P
    		python-libxml2-2.9.4-46.15.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48092
    P
    		libapr-util1-1.5.3-2.8.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47868
    P
    		python-pyOpenSSL-16.0.0-4.6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48196
    P
    		libspice-client-glib-2_0-8-0.33-3.6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48077
    P
    		libXfont1-1.5.1-11.3.12 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:100910
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71989
    P
    		libxml2-2-2.9.7-3.28.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62152
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72105
    P
    		zoo-2.10-1.29 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71893
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:51609
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:68195
    P
    		Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP2) (Important)
    2021-06-18
    oval:org.opensuse.security:def:48406
    P
    		dracut-044-87.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48778
    P
    		icu-52.1-7.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48420
    P
    		fuse-2.9.3-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48866
    P
    		libpolkit0-32bit-0.113-5.6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48630
    P
    		sysconfig-0.84.0-13.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48782
    P
    		lcms-1.19-17.31 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48538
    P
    		libpoppler-glib8-0.43.0-15.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48568
    P
    		libvte9-0.28.2-19.7 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48928
    P
    		libiso9660-8-0.90-6.3.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:1988
    P
    		pam-modules-12.1-3.17 on GA media (Moderate)
    2021-04-29
    oval:org.opensuse.security:def:51876
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:49300
    P
    		Security update for python-paramiko (Important)
    2021-01-07
    oval:org.opensuse.security:def:49138
    P
    		Security update for slurm_18_08 (Important)
    2020-12-17
    oval:org.opensuse.security:def:49033
    P
    		libraw9-0.15.4-30.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71435
    P
    		apache2-2.4.43-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2497
    P
    		libntfs-3g87-2016.2.22-3.3.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:48993
    P
    		gstreamer-0_10-plugins-base-0.10.36-18.3.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61816
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49014
    P
    		libiso9660-8-0.90-6.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49024
    P
    		libosip2-3.5.0-20.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:116720
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2519
    P
    		argyllcms-1.9.2-2.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49015
    P
    		libjavascriptcoregtk-1_0-0-2.4.11-23.20 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2548
    P
    		libstaroffice-0_0-0-0.0.6-5.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71548
    P
    		libblkid-devel-2.33.1-4.5.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2198
    P
    		memcached-1.5.6-4.5.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71557
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2507
    P
    		libwmf-0_2-7-0.2.8.4-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2539
    P
    		libntfs-3g-devel-2016.2.22-3.5.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:100496
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:48992
    P
    		gstreamer-0_10-plugins-bad-0.10.23-25.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2501
    P
    		libpskc-devel-2.6.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2533
    P
    		imobiledevice-tools-1.2.0+git20180427.26373b3-1.40 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107162
    P
    		libgcrypt-devel-1.8.2-8.36.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2572
    P
    		Security update for openldap2 (Important)
    2020-12-02
    oval:org.opensuse.security:def:2768
    P
    		Security update for libvpx (Important)
    2020-12-02
    oval:org.opensuse.security:def:2800
    P
    		Security update for wireshark (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2839
    P
    		Security update for openexr (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2588
    P
    		Security update for python-pip (Important)
    2020-12-02
    oval:org.opensuse.security:def:2764
    P
    		Security update for openexr (Low)
    2020-12-02
    oval:org.opensuse.security:def:2586
    P
    		Security update for mariadb (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2786
    P
    		Security update for exempi (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2815
    P
    		Security update for libjpeg-turbo (Important)
    2020-12-02
    oval:org.opensuse.security:def:2855
    P
    		Security update for tiff (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2853
    P
    		Security update for jasper (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2578
    P
    		Security update for krb5 (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2774
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-02
    oval:org.opensuse.security:def:2806
    P
    		Security update for libopenmpt (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:2845
    P
    		Security update for MozillaFirefox (Important)
    2020-12-02
    oval:org.opensuse.security:def:49876
    P
    		gv on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50527
    P
    		Security update for supportutils (Important)
    2020-12-01
    oval:org.opensuse.security:def:50425
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49511
    P
    		fetchmailconf on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50361
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:50004
    P
    		guestfs-data on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49305
    P
    		ppc64-diag on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64848
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66371
    P
    		cups-filters on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49114
    P
    		gstreamer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50635
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49778
    P
    		crash on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49203
    P
    		libnm0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49365
    P
    		yast2-security on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50271
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49766
    P
    		FastCGI on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50333
    P
    		Security update for libarchive (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:65405
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49281
    P
    		opensc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49234
    P
    		libsnmp30 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50164
    P
    		libstaroffice-0_0-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49076
    P
    		cups-filters on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50371
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:73036
    P
    		augeas on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49282
    P
    		openslp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50229
    P
    		gnome-shell-calendar on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49632
    P
    		gnome-shell on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49160
    P
    		libbsd-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50033
    P
    		sblim-sfcb on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50600
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:66463
    P
    		libgcrypt-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49609
    P
    		NetworkManager on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50260
    P
    		Security update for unzip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49168
    P
    		libgcrypt-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50431
    P
    		Security update for openssl-1_1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:68649
    P
    		Security update for perl-YAML-LibYAML (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50094
    P
    		rarpd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50581
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:49095
    P
    		fuse on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50496
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:73154
    P
    		libgcrypt-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49427
    P
    		libXvnc-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:103829
    P
    		Security update for libgcrypt (Moderate)
    2019-07-25
    oval:org.opensuse.security:def:97736
    P
    		Security update for libgcrypt (Moderate)
    2019-07-25
    oval:org.opensuse.security:def:90174
    P
    		Security update for libgcrypt (Moderate)
    2019-07-25
    oval:org.opensuse.security:def:104426
    P
    		Security update for libgcrypt (Moderate)
    2019-07-25
    oval:org.opensuse.security:def:90771
    P
    		Security update for libgcrypt (Moderate)
    2019-07-25
    oval:com.ubuntu.disco:def:2019129040000000
    V
    		CVE-2019-12904 on Ubuntu 19.04 (disco) - low.
    2019-06-20
    oval:com.ubuntu.bionic:def:2019129040000000
    V
    		CVE-2019-12904 on Ubuntu 18.04 LTS (bionic) - low.
    2019-06-20
    oval:com.ubuntu.cosmic:def:2019129040000000
    V
    		CVE-2019-12904 on Ubuntu 18.10 (cosmic) - medium.
    2019-06-19
    oval:com.ubuntu.xenial:def:2019129040000000
    V
    		CVE-2019-12904 on Ubuntu 16.04 LTS (xenial) - medium.
    2019-06-19
    BACK
    gnupg libgcrypt 1.8.4
    opensuse leap 15.0
    gnupg libgcrypt 1.8.4