2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2016-6313" ,
"sourceIdentifier" : "secalert@redhat.com" ,
"published" : "2016-12-13T20:59:04.267" ,
2023-11-07 21:03:21 +00:00
"lastModified" : "2023-11-07T02:33:57.647" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Modified" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits."
} ,
{
"lang" : "es" ,
"value" : "Las funciones de mezcla en el generador de n\u00fameros aleatorios en Libgcrypt en versiones anteriores a 1.5.6, 1.6.x en versiones anteriores a 1.6.6 y 1.7.x en versiones anteriores a 1.7.3 y GnuPG en versiones anteriores a 1.4.21 hacen m\u00e1s f\u00e1cil para atacantes obtener valores de 160 bits aprovechando el conocimiento de los 4640 bits previos."
}
] ,
"metrics" : {
"cvssMetricV30" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.0" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.3 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 1.4
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.0
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-200"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "1.5.3" ,
"matchCriteriaId" : "5B83822B-BC72-455D-A350-7DC9545E14A9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "3EC9966B-2C22-4DC5-BAFA-8BFFACF03048"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C7D6A352-8F0D-4C4E-9D99-E47E63C2800C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "204BCDDC-1B38-4905-BD99-38E712FCB136"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "44EDEC6E-B053-4162-B5BF-45975B457E2F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "84491FE3-2FF4-4953-B0AC-57C4F3BE409A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.6.5:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2DA8E460-8258-46D7-875E-DC389652392A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.7.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A52C9BAF-4EE6-4371-A0B7-0DB0CE429D64"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.7.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "68024F0D-19A3-4E20-B2A6-4E65278777F4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:libgcrypt:1.7.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0A012DAB-3F4B-4236-9B6A-16B38B3F4ED9"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*" ,
"matchCriteriaId" : "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*" ,
"matchCriteriaId" : "B5A6F2F3-4894-4392-8296-3B8DD2679084"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" ,
"matchCriteriaId" : "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "1.4.14" ,
"matchCriteriaId" : "DD2DC7AC-70A6-433A-9104-2BF05CA1F02D"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://rhn.redhat.com/errata/RHSA-2016-2674.html" ,
"source" : "secalert@redhat.com"
} ,
{
"url" : "http://www.debian.org/security/2016/dsa-3649" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.debian.org/security/2016/dsa-3650" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.securityfocus.com/bid/92527" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://www.securitytracker.com/id/1036635" ,
"source" : "secalert@redhat.com"
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-3064-1" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-3065-1" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS" ,
"source" : "secalert@redhat.com"
2023-04-24 12:24:31 +02:00
} ,
{
"url" : "https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html" ,
"source" : "secalert@redhat.com" ,
"tags" : [
"Mailing List" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://security.gentoo.org/glsa/201610-04" ,
"source" : "secalert@redhat.com"
} ,
{
"url" : "https://security.gentoo.org/glsa/201612-01" ,
"source" : "secalert@redhat.com"
}
]
}
