{"id":"CVE-2019-13627","title":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library","summary":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-203","CWE-362"],"vendor":"libgcrypt20_project","product":"libgcrypt20","affected":["ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.04","ubuntu_linux = 19.10","leap = 15.0","leap = 15.1","libgcrypt20 = 1.6.3-2+deb8u4","libgcrypt20 = 1.7.6-2+deb9u3","libgcrypt20 = 1.8.4-5"],"published":"2019-09-25","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:46.647","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-13627","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/10/02/2","label":"cve@mitre.org"},{"url":"https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html","label":"cve@mitre.org"},{"url":"https://minerva.crocs.fi.muni.cz/","label":"cve@mitre.org"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13627","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202003-32","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4236-1/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4236-2/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4236-3/","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/10/02/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://minerva.crocs.fi.muni.cz/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13627","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-32","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4236-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4236-2/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4236-3/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-13627.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-13627"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764018"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13627"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13627"},{"url":"https://dev.gnupg.org/T4683"},{"url":"https://access.redhat.com/errata/RHSA-2020:4482"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00545,"epssPercentile":0.45536,"ingestedAt":"2026-10-14T07:21:04.820Z","patched":["enterprise_linux_baseos_v_8"],"slug":"CVE-2019-13627","body":"## Overview\n\nIt was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.\n\n## Affected\n\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.04`\n- `ubuntu_linux = 19.10`\n- `leap = 15.0`\n- `leap = 15.1`\n- `libgcrypt20 = 1.6.3-2+deb8u4`\n- `libgcrypt20 = 1.7.6-2+deb9u3`\n- `libgcrypt20 = 1.8.4-5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2020:4482** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4482)","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}