---
id: CVE-2019-13627
title: >-
  It was discovered that there was a ECDSA timing attack in the libgcrypt20
  cryptographic library
summary: >-
  It was discovered that there was a ECDSA timing attack in the libgcrypt20
  cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and
  1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-203
  - CWE-362
vendor: libgcrypt20_project
product: libgcrypt20
affected:
  - ubuntu_linux = 12.04
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.04
  - ubuntu_linux = 19.10
  - leap = 15.0
  - leap = 15.1
  - libgcrypt20 = 1.6.3-2+deb8u4
  - libgcrypt20 = 1.7.6-2+deb9u3
  - libgcrypt20 = 1.8.4-5
published: '2019-09-25'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:46.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-13627'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2019/10/02/2'
    label: cve@mitre.org
  - url: 'https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html'
    label: cve@mitre.org
  - url: 'https://minerva.crocs.fi.muni.cz/'
    label: cve@mitre.org
  - url: 'https://security-tracker.debian.org/tracker/CVE-2019-13627'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202003-32'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4236-1/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4236-2/'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4236-3/'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2019/10/02/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://minerva.crocs.fi.muni.cz/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security-tracker.debian.org/tracker/CVE-2019-13627'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202003-32'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4236-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4236-2/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4236-3/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-13627.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-13627'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1764018'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-13627'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-13627'
  - url: 'https://dev.gnupg.org/T4683'
  - url: 'https://access.redhat.com/errata/RHSA-2020:4482'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00545
epssPercentile: 0.45536
ingestedAt: '2026-10-14T07:21:04.820Z'
patched:
  - enterprise_linux_baseos_v_8
---

## Overview

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

## Affected

- `ubuntu_linux = 12.04`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.04`
- `ubuntu_linux = 19.10`
- `leap = 15.0`
- `leap = 15.1`
- `libgcrypt20 = 1.6.3-2+deb8u4`
- `libgcrypt20 = 1.7.6-2+deb9u3`
- `libgcrypt20 = 1.8.4-5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2020:4482** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2020-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2020:4482)