Issued:

2016-11-08

Updated:

2016-11-08

RHSA-2016:2674 - Moderate: libgcrypt security update

Synopsis

Moderate: libgcrypt security update

Type/Severity

Security Advisory Moderate

Topic

An update for libgcrypt is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.

Security Fix(es):

• A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. (CVE-2016-6313)

Red Hat would like to thank Felix Dörre and Vladimir Klebanov for reporting this issue.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• libgcrypt-debuginfo-1.5.3-13.el7_3.1.ppc64.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.s390x.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.s390.rpm
• libgcrypt-devel-1.4.5-12.el6_8.x86_64.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.ppc64.rpm
• libgcrypt-1.4.5-12.el6_8.s390x.rpm
• libgcrypt-1.4.5-12.el6_8.i686.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.i686.rpm
• libgcrypt-1.4.5-12.el6_8.src.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.s390.rpm
• libgcrypt-1.4.5-12.el6_8.x86_64.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.ppc.rpm
• libgcrypt-devel-1.4.5-12.el6_8.s390.rpm
• libgcrypt-1.5.3-13.el7_3.1.src.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.ppc64.rpm
• libgcrypt-1.5.3-13.el7_3.1.aarch64.rpm
• libgcrypt-1.5.3-13.el7_3.1.x86_64.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.x86_64.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.s390.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.aarch64.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.ppc64le.rpm
• libgcrypt-1.5.3-13.el7_3.1.i686.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.aarch64.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.x86_64.rpm
• libgcrypt-1.5.3-13.el7_3.1.s390x.rpm
• libgcrypt-devel-1.4.5-12.el6_8.ppc64.rpm
• libgcrypt-1.5.3-13.el7_3.1.s390.rpm
• libgcrypt-devel-1.4.5-12.el6_8.i686.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.s390x.rpm
• libgcrypt-1.5.3-13.el7_3.1.ppc.rpm
• libgcrypt-debuginfo-1.5.3-13.el7_3.1.i686.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.ppc.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.ppc64le.rpm
• libgcrypt-1.5.3-13.el7_3.1.ppc64le.rpm
• libgcrypt-1.4.5-12.el6_8.s390.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.i686.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.ppc.rpm
• libgcrypt-1.4.5-12.el6_8.ppc.rpm
• libgcrypt-devel-1.4.5-12.el6_8.ppc.rpm
• libgcrypt-devel-1.4.5-12.el6_8.s390x.rpm
• libgcrypt-devel-1.5.3-13.el7_3.1.x86_64.rpm
• libgcrypt-1.4.5-12.el6_8.ppc64.rpm
• libgcrypt-debuginfo-1.4.5-12.el6_8.s390x.rpm
• libgcrypt-1.5.3-13.el7_3.1.ppc64.rpm

Fixes

• This content is not included.BZ - 1366105

CVEs

• CVE-2016-6313

References

• https://access.redhat.com/security/updates/classification/#moderate

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.