CVE-2021-40528 describes a plaintext recovery vulnerability in the ElGamal implementation of Libgcrypt versions prior to 1.9.4, impacting products like GnuPG. This medium-severity flaw (CVSS 5.9) allows an attacker to recover plaintext due to a dangerous combination of cryptographic parameters during cross-library interaction, specifically affecting OpenPGP. While the attack complexity is high, successful exploitation could lead to complete confidentiality compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.9.4CPE matchmatch criteria | cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because during interaction between two cryptographic libraries a certain dangerous combination of the prime defined by the receiver's public key the generator defined by the receiver's public key and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Sep 14, 2021libgcrypt: ElGamal implementation allows plaintext recovery
Jul 20, 2021