CVE-2018-6829

{"id": "CVE-2018-6829", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-02-07T23:29:01.703", "references": [{"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.oracle.com/security-alerts/cpujan2020.html", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation."}, {"lang": "es", "value": "cipher/elgamal.c en Libgcrypt hasta la versi\u00f3n 1.8.2, al emplearse para cifrar mensajes directamente, cifra los textos planos indebidamente, lo que permite que atacantes remotos obtengan informaci\u00f3n sensible mediante la lectura de datos en texto cifrado (p.ej., no tiene seguridad sem\u00e1ntica a la hora de enfrentarse a un ataque solo en texto cifrado). La hip\u00f3tesis DDH (Decisional Diffie-Hellman) no soporta la implementaci\u00f3n ElGamal de Libgcrypt."}], "lastModified": "2020-01-15T20:15:18.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "996E6EFF-9824-4EC3-9DA8-A6B0282603BF", "versionEndIncluding": "1.8.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}