{"api_version":"1","generated_at":"2026-07-23T09:55:01+00:00","cve":"CVE-2013-4576","urls":{"html":"https://cve.report/CVE-2013-4576","api":"https://cve.report/api/cve/CVE-2013-4576.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-4576","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4576"},"summary":{"title":"CVE-2013-4576","description":"GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-12-20 21:55:06","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-255","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.1","severity":"","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2821","name":"http://www.debian.org/security/2013/dsa-2821","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-2821-1 gnupg","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html","name":"http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"[Announce] [security fix] GnuPG 1.4.16 released","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf","name":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1029513","name":"http://www.securitytracker.com/id/1029513","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"GnuPG Acoustic Side-Channel Attack Lets Local Users Recover RSA Secret Keys - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-2059-1","name":"http://www.ubuntu.com/usn/USN-2059-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-2059-1: GnuPG vulnerability | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89846","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89846","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/101170","name":"http://osvdb.org/101170","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://seclists.org/oss-sec/2013/q4/523","name":"http://seclists.org/oss-sec/2013/q4/523","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-sec: Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0016.html","name":"http://rhn.redhat.com/errata/RHSA-2014-0016.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/64424","name":"http://www.securityfocus.com/bid/64424","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"GnuPG RSA Key Extraction Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://seclists.org/oss-sec/2013/q4/520","name":"http://seclists.org/oss-sec/2013/q4/520","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-sec: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.cs.tau.ac.il/~tromer/acoustic/","name":"http://www.cs.tau.ac.il/~tromer/acoustic/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Acoustic cryptanalysis","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4576","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4576","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.4","cpe7":"-","cpe8":"win32","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.5","cpe7":"-","cpe8":"win32","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.1","cpe7":"windows","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.2.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.90","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.91","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.92","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.3.93","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"1.4.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4576","vulnerable":"1","versionEndIncluding":"1.4.15","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gnupg","cpe5":"gnupg","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2013","cve_id":"4576","cve":"CVE-2013-4576","epss":"0.001080000","percentile":"0.286660000","score_date":"2026-04-30","updated_at":"2026-05-01 00:10:53"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T16:45:14.839Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"64424","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/64424"},{"name":"USN-2059-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-2059-1"},{"name":"101170","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/101170"},{"name":"[gnupg-devel] 20131218 [Announce] [security fix] GnuPG 1.4.16 released","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html"},{"name":"RHSA-2014:0016","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-0016.html"},{"name":"1029513","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029513"},{"name":"gunpg-cve20134576-info-disclosure(89846)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89846"},{"name":"DSA-2821","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2013/dsa-2821"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf"},{"name":"[oss-security] 20131218 Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://seclists.org/oss-sec/2013/q4/523"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.cs.tau.ac.il/~tromer/acoustic/"},{"name":"[oss-security] 20131218 GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://seclists.org/oss-sec/2013/q4/520"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-12-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"64424","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/64424"},{"name":"USN-2059-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-2059-1"},{"name":"101170","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/101170"},{"name":"[gnupg-devel] 20131218 [Announce] [security fix] GnuPG 1.4.16 released","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html"},{"name":"RHSA-2014:0016","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-0016.html"},{"name":"1029513","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029513"},{"name":"gunpg-cve20134576-info-disclosure(89846)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89846"},{"name":"DSA-2821","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2013/dsa-2821"},{"tags":["x_refsource_MISC"],"url":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf"},{"name":"[oss-security] 20131218 Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://seclists.org/oss-sec/2013/q4/523"},{"tags":["x_refsource_MISC"],"url":"http://www.cs.tau.ac.il/~tromer/acoustic/"},{"name":"[oss-security] 20131218 GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://seclists.org/oss-sec/2013/q4/520"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2013-4576","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"64424","refsource":"BID","url":"http://www.securityfocus.com/bid/64424"},{"name":"USN-2059-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-2059-1"},{"name":"101170","refsource":"OSVDB","url":"http://osvdb.org/101170"},{"name":"[gnupg-devel] 20131218 [Announce] [security fix] GnuPG 1.4.16 released","refsource":"MLIST","url":"http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html"},{"name":"RHSA-2014:0016","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-0016.html"},{"name":"1029513","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029513"},{"name":"gunpg-cve20134576-info-disclosure(89846)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89846"},{"name":"DSA-2821","refsource":"DEBIAN","url":"http://www.debian.org/security/2013/dsa-2821"},{"name":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf","refsource":"MISC","url":"http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf"},{"name":"[oss-security] 20131218 Re: GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","refsource":"MLIST","url":"http://seclists.org/oss-sec/2013/q4/523"},{"name":"http://www.cs.tau.ac.il/~tromer/acoustic/","refsource":"MISC","url":"http://www.cs.tau.ac.il/~tromer/acoustic/"},{"name":"[oss-security] 20131218 GnuPG 1.4.16 fixes RSA key extraction via acoustic side channel (CVE-2013-4576)","refsource":"MLIST","url":"http://seclists.org/oss-sec/2013/q4/520"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-4576","datePublished":"2013-12-20T21:00:00.000Z","dateReserved":"2013-06-12T00:00:00.000Z","dateUpdated":"2024-08-06T16:45:14.839Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-12-20 21:55:06","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-255","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.15","matchCriteriaId":"3A287B57-D002-4A42-96F1-E1F701F9762C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B6863306-F7B8-47D9-8FF9-4340FC6D718F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"BA95D254-1D85-4523-9DF2-8A07BF05573E"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"9E24FB9C-1CA9-4A1B-8AF6-06B3C1865EF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"D07D0653-4538-47D8-AB8F-0A23D65F0AE0"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.4:*:*:*:*:*:*:*","matchCriteriaId":"95E18355-65AF-4DB4-B6B2-431D7788FF23"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.4:-:win32:*:*:*:*:*","matchCriteriaId":"0E61804F-21BA-4850-B859-D69C80F37FFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.5:*:*:*:*:*:*:*","matchCriteriaId":"88C40692-FE9F-48D6-9AEB-5F35FA369980"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.5:-:win32:*:*:*:*:*","matchCriteriaId":"585F51C8-2FDC-46CE-9F71-ED9EE2ADA472"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.6:*:*:*:*:*:*:*","matchCriteriaId":"18395DAB-24DA-4ABD-ABD8-38A49417B052"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.0.7:*:*:*:*:*:*:*","matchCriteriaId":"6228E3FF-5EB4-4F46-9EA8-1B114947994D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"96DEF388-2B09-4212-8AF5-9FE54CCAFEC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.1:*:*:*:*:*:*:*","matchCriteriaId":"1A798490-741B-4EB4-B1D9-353A181A7AA2"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.1:windows:*:*:*:*:*:*","matchCriteriaId":"F781A379-57DF-4D1E-8B85-4FD637E4B967"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.2:*:*:*:*:*:*:*","matchCriteriaId":"8466E9BD-5623-40EE-A604-0F29C3520B63"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.3:*:*:*:*:*:*:*","matchCriteriaId":"4E98B61C-7093-4251-B1D8-59B647C2DF6B"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.4:*:*:*:*:*:*:*","matchCriteriaId":"6F9FCAC0-08D1-4044-A506-4AC14BF381CA"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.5:*:*:*:*:*:*:*","matchCriteriaId":"545E4C50-229D-4B27-9DB2-9D1204451A9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.6:*:*:*:*:*:*:*","matchCriteriaId":"D50A16A8-9C96-47CB-B18B-AE79C754ABBC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.2.7:*:*:*:*:*:*:*","matchCriteriaId":"08877372-B7DD-4543-84A8-C40D2BA100F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"7135BE6C-E797-4C41-BCD5-161DC7561433"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.1:*:*:*:*:*:*:*","matchCriteriaId":"E909F1D4-AFB1-43F3-9635-E318D64099B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.2:*:*:*:*:*:*:*","matchCriteriaId":"DB4AAE4C-3F59-46D3-A38E-CC5DFCBEC3DF"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.3:*:*:*:*:*:*:*","matchCriteriaId":"688CDCA9-2809-4C0E-9DBC-133F48D56BEA"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.4:*:*:*:*:*:*:*","matchCriteriaId":"564B521B-3C7C-46CF-94E8-A368AF81DA54"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.6:*:*:*:*:*:*:*","matchCriteriaId":"FC04BFA0-C7B0-4F70-9676-8156C9CE18AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.90:*:*:*:*:*:*:*","matchCriteriaId":"9F43CE80-06BC-4448-9033-F2F88663C527"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.91:*:*:*:*:*:*:*","matchCriteriaId":"A7181202-BC32-4F1E-9EF8-F544CCDA1671"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.92:*:*:*:*:*:*:*","matchCriteriaId":"F55827F8-CC36-45DA-8F9E-1F520911EB12"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.3.93:*:*:*:*:*:*:*","matchCriteriaId":"CCEAA5DF-33D1-4D4A-BA01-4BC863DBC272"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4:*:*:*:*:*:*:*","matchCriteriaId":"365FF476-1FFD-4E09-900C-50E0660766AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"28374619-966D-4F38-B83E-A6296F27CC05"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.2:*:*:*:*:*:*:*","matchCriteriaId":"22A28CDF-F2AF-4D49-9FB1-AED34A758289"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.3:*:*:*:*:*:*:*","matchCriteriaId":"6399A22D-90DF-4CB5-9367-0C5242BD1A2B"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.4:*:*:*:*:*:*:*","matchCriteriaId":"D63B0B4A-3998-4A4F-AD7A-BB8CEBE897B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.5:*:*:*:*:*:*:*","matchCriteriaId":"FDA6934A-3D02-4749-A147-BE538C0AF27F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.6:*:*:*:*:*:*:*","matchCriteriaId":"8B238CA5-3B4D-4D6A-92CA-39A7CD57AF40"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.8:*:*:*:*:*:*:*","matchCriteriaId":"DC6150E3-1D7C-44DA-BA57-35AB26F881B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.10:*:*:*:*:*:*:*","matchCriteriaId":"3EB20A34-5E11-4D70-B3DE-66DD9863AE0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.11:*:*:*:*:*:*:*","matchCriteriaId":"CA47467D-3D96-46DB-B0AC-D28586829710"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.12:*:*:*:*:*:*:*","matchCriteriaId":"68B68F2F-0718-4C87-9629-4657DC49EECC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.13:*:*:*:*:*:*:*","matchCriteriaId":"69D492F9-2064-488A-BD16-99DD865D2BF6"},{"vulnerable":true,"criteria":"cpe:2.3:a:gnupg:gnupg:1.4.14:*:*:*:*:*:*:*","matchCriteriaId":"B4929286-63C2-45D0-B0C7-E14438D82883"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"4576","Ordinal":"1","Title":"CVE-2013-4576","CVE":"CVE-2013-4576","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"4576","Ordinal":"1","NoteData":"GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.","Type":"Description","Title":"CVE-2013-4576"},{"CveYear":"2013","CveId":"4576","Ordinal":"2","NoteData":"2013-12-20","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"4576","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}