What’s Vulnerable › Vulnerabilities

CVE-2024-2236: Libgcrypt: vulnerable to marvin attack

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-06 · updated 2026-10-15
• Weakness: CWE-385

Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Affected products

• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions — fixed in 0:1.10.0-11.el9
• Red Hat Enterprise Linux 9.2 Extended Update Support: all versions — fixed in 0:1.10.0-10.el9_2.1
• Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:1.10.0-10.el9_4.1

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 9 0:1.10.0-11.el9; Red Hat Enterprise Linux 9.2 Extended Update Support 0:1.10.0-10.el9_2.1; Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.10.0-10.el9_4.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:9404
• https://access.redhat.com/errata/RHSA-2025:3530
• https://access.redhat.com/errata/RHSA-2025:3534
• https://access.redhat.com/security/cve/CVE-2024-2236
• https://bugzilla.redhat.com/show_bug.cgi?id=2245218
• https://access.redhat.com/security/cve/CVE-2024-2236
• https://bugzilla.redhat.com/show_bug.cgi?id=2245218
• https://bugzilla.redhat.com/show_bug.cgi?id=2268268
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2024-2236 or the next vulnerability affects your stack