CVE-2019-13627
libgcrypt: ECDSA timing attack allowing private key leak
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 2, 2019
Updated · October 14, 2026
Description
A timing attack was found in the way ECCDSA was implemented in libgcrypt. A man-in-the-middle attacker could use this attack during signature generation to recover the private key. This attack is only feasible when the attacker is local to the machine where the signature is being generated. Attacks over the network or via the internet are not feasible.
Statement
The versions of libgcrypt shipped with Red Hat Enterprise Linux 5, 6 and 7 do not support ECC, therefore they are not affected by this flaw.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 6.3CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')