What’s Vulnerable › Vulnerabilities

CVE-2014-5270

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-10-10 · updated 2026-06-17
• Weakness: CWE-200

Description

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.

Affected products

• Debian Linux: 7.0
• gnupg Libgcrypt: through 1.5.3; 1.4.0, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.5.0 (+2)

References

• http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
• http://openwall.com/lists/oss-security/2014/08/16/2
• http://www.cs.tau.ac.il/~tromer/handsoff/
• http://www.debian.org/security/2014/dsa-3024
• http://www.debian.org/security/2014/dsa-3073
• http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html
• http://openwall.com/lists/oss-security/2014/08/16/2
• http://www.cs.tau.ac.il/~tromer/handsoff/
• http://www.debian.org/security/2014/dsa-3024
• http://www.debian.org/security/2014/dsa-3073

Get alerted when CVE-2014-5270 or the next vulnerability affects your stack