CVE-2016-6313

NameCVE-2016-6313
DescriptionThe mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-600-1, DLA-602-1, DSA-3649-1, DSA-3650-1
Debian Bugs834893, 834894

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg1 (PTS)buster1.4.23-1fixed
trixie, bookworm, bullseye1.4.23-1.1fixed
sid1.4.23-2fixed
gnupg2 (PTS)buster, buster (security)2.2.12-1+deb10u2fixed
bullseye (security), bullseye2.2.27-2+deb11u2fixed
trixie, bookworm2.2.40-1.1fixed
sid2.2.40-3fixed
libgcrypt20 (PTS)buster1.8.4-5+deb10u1fixed
bullseye1.8.7-6fixed
bookworm1.10.1-3fixed
sid, trixie1.10.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsourcewheezy1.4.12-7+deb7u8DLA-602-1
gnupgsourcejessie1.4.18-7+deb8u2DSA-3649-1
gnupgsource(unstable)(unfixed)834893
gnupg1source(unstable)1.4.21-1834894
gnupg2source(unstable)(not affected)
libgcrypt11sourcewheezy1.5.0-5+deb7u5DLA-600-1
libgcrypt11source(unstable)(unfixed)
libgcrypt20sourcejessie1.6.3-2+deb8u2DSA-3650-1
libgcrypt20source(unstable)1.7.3-1

Notes

- gnupg2 <not-affected> (Uses system libgcrypt)
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=e23eec8c9a602eee0a09851a54db0f5d611f125c
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=c6dbfe89903d0c8191cf50ecf1abb3c8458b427a
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=2f62103b4bb6d6f9ce806e01afb7fdc58aa33513 (1.7)
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=8dd45ad957b54b939c288a68720137386c7f6501 (1.7)
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=190b0429b70eb4a3573377e95755d9cc13c38461 (1.6)
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=c748f87436d693f092a4484571a3cc7f650b5c81 (1.6)
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=98980e2fd29ad62903c78fa6521489fce651cdda
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=6199cd963d1fba86e0b7b9e2de4b6c00b945193a
https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html

Search for package or bug name: Reporting problems