CVE-2014-3591

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

• CWE-200

• http://www.cs.tau.ac.il/~tromer/radioexp/Third Party Advisory
• http://www.debian.org/security/2015/dsa-3184Third Party Advisory
• http://www.debian.org/security/2015/dsa-3185Third Party Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.htmlPatch, Release Notes, Vendor Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.htmlPatch, Vendor Advisory
• http://www.cs.tau.ac.il/~tromer/radioexp/Third Party Advisory
• http://www.debian.org/security/2015/dsa-3184Third Party Advisory
• http://www.debian.org/security/2015/dsa-3185Third Party Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.htmlPatch, Release Notes, Vendor Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.htmlPatch, Vendor Advisory

Published

Nov 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3585redhat-upgrade-tool: Does not check GPG signatures when upgr…9.8
• CVE-2014-3586The default configuration for the Command Line Interface in …
• CVE-2014-3587Integer overflow in the cdf_read_property_info function in c…
• CVE-2014-3588Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3589PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and P…
• CVE-2014-3590Versions of Foreman as shipped with Red Hat Satellite 6 does…6.5
• CVE-2014-3592OpenShift Origin: Improperly validated team names could allo…6.1
• CVE-2014-3593Eval injection vulnerability in luci 0.26.0 allows remote au…
• CVE-2014-3594Cross-site scripting (XSS) vulnerability in the Host Aggrega…
• CVE-2014-3595Cross-site scripting (XSS) vulnerability in spacewalk-java 1…
• CVE-2014-3596The getCN function in Apache Axis 1.4 and earlier does not p…
• CVE-2014-3597Multiple buffer overflows in the php_parserr function in ext…