USN-3733-1: GnuPG vulnerability

Releases

• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• gnupg - GNU privacy guard - a free PGP replacement

Details

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink,
Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom
discovered that GnuPG is vulnerable to a cache side-channel attack. A local
attacker could use this attack to recover RSA private keys.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

• gnupg - 1.4.20-1ubuntu3.3
• gnupg-curl - 1.4.20-1ubuntu3.3
• gpgv - 1.4.20-1ubuntu3.3

Ubuntu 14.04

• gnupg - 1.4.16-1ubuntu2.6
• gnupg-curl - 1.4.16-1ubuntu2.6
• gpgv - 1.4.16-1ubuntu2.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2017-7526
• https://launchpad.net/bugs/1785176

Related notices

• USN-3733-2: gpgv, gnupg, gnupg-curl
• USN-3347-2: libgcrypt11
• USN-3347-1: libgcrypt11-udeb, libgcrypt20-dev, libgcrypt20, libgcrypt11-dev, libgcrypt11-doc, libgcrypt11, libgcrypt20-udeb, libgcrypt20-doc