CVE-2013-4576
Estado: ModificadaBaja (2.1)—
GnuPG 1.x anteriores a 1.4.16 genera claves RSA utilizando secuencias de introducciones con ciertos patrones que introducen un ataque de canal lateral, lo cual permite a atacantes físicamente próximos extraer claves RSA a través de un ataque de texto cifrado elegido y criptoanálisis acústico durante el descifrado. NOTA: normalmente no se espera de las aplicaciones que se protejan ante ataques laterales acústicos, dado que esto es responsabilidad del dispositivo físico. De esta manera, problemas de este tipo no recibirán normalmente un identificador CVE.
Leer descripción completaMostrar menos
En cualquier caso, para este problema, el desarrollador a especificado una política de seguridad en la cual GnuPG debería ofrecer resistencia ante cnales laterales, y violaciones de políticas de seguridad específicas para los desarrolladores están dentro del ámbito de CVE.
CVSS
- Versión: 2.0
- Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
- Puntuación base: 2.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.45%
- Percentil entre todas las CVEs puntuadas: 37
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-255
Referencias
- http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html
- http://osvdb.org/101170
- http://rhn.redhat.com/errata/RHSA-2014-0016.html
- http://seclists.org/oss-sec/2013/q4/520
- http://seclists.org/oss-sec/2013/q4/523
- http://www.cs.tau.ac.il/~tromer/acoustic/
- http://www.debian.org/security/2013/dsa-2821
- http://www.securityfocus.com/bid/64424
- http://www.securitytracker.com/id/1029513
- http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf
- http://www.ubuntu.com/usn/USN-2059-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89846
- http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html
- http://osvdb.org/101170
- http://rhn.redhat.com/errata/RHSA-2014-0016.html
- http://seclists.org/oss-sec/2013/q4/520
- http://seclists.org/oss-sec/2013/q4/523
- http://www.cs.tau.ac.il/~tromer/acoustic/
- http://www.debian.org/security/2013/dsa-2821
- http://www.securityfocus.com/bid/64424
- http://www.securitytracker.com/id/1029513
- http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf
- http://www.ubuntu.com/usn/USN-2059-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89846
JSON original (NVD)
Mostrar
{
"id": "CVE-2013-4576",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 2.1,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2013-12-20T21:55:06.930",
"references": [
{
"url": "http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://osvdb.org/101170",
"source": "secalert@redhat.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2014-0016.html",
"source": "secalert@redhat.com"
},
{
"url": "http://seclists.org/oss-sec/2013/q4/520",
"source": "secalert@redhat.com"
},
{
"url": "http://seclists.org/oss-sec/2013/q4/523",
"source": "secalert@redhat.com"
},
{
"url": "http://www.cs.tau.ac.il/~tromer/acoustic/",
"source": "secalert@redhat.com"
},
{
"url": "http://www.debian.org/security/2013/dsa-2821",
"source": "secalert@redhat.com"
},
{
"url": "http://www.securityfocus.com/bid/64424",
"source": "secalert@redhat.com"
},
{
"url": "http://www.securitytracker.com/id/1029513",
"source": "secalert@redhat.com"
},
{
"url": "http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf",
"source": "secalert@redhat.com"
},
{
"url": "http://www.ubuntu.com/usn/USN-2059-1",
"source": "secalert@redhat.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89846",
"source": "secalert@redhat.com"
},
{
"url": "http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/101170",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2014-0016.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/oss-sec/2013/q4/520",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/oss-sec/2013/q4/523",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.cs.tau.ac.il/~tromer/acoustic/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2013/dsa-2821",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/64424",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1029513",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-2059-1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89846",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-255"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE."
},
{
"lang": "es",
"value": "GnuPG 1.x anteriores a 1.4.16 genera claves RSA utilizando secuencias de introducciones con ciertos patrones que introducen un ataque de canal lateral, lo cual permite a atacantes físicamente próximos extraer claves RSA a través de un ataque de texto cifrado elegido y criptoanálisis acústico durante el descifrado. NOTA: normalmente no se espera de las aplicaciones que se protejan ante ataques laterales acústicos, dado que esto es responsabilidad del dispositivo físico. De esta manera, problemas de este tipo no recibirán normalmente un identificador CVE. En cualquier caso, para este problema, el desarrollador a especificado una política de seguridad en la cual GnuPG debería ofrecer resistencia ante cnales laterales, y violaciones de políticas de seguridad específicas para los desarrolladores están dentro del ámbito de CVE."
}
],
"lastModified": "2026-06-16T23:57:28.957",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A287B57-D002-4A42-96F1-E1F701F9762C",
"versionEndIncluding": "1.4.15"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6863306-F7B8-47D9-8FF9-4340FC6D718F"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA95D254-1D85-4523-9DF2-8A07BF05573E"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E24FB9C-1CA9-4A1B-8AF6-06B3C1865EF0"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D07D0653-4538-47D8-AB8F-0A23D65F0AE0"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95E18355-65AF-4DB4-B6B2-431D7788FF23"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.4:-:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E61804F-21BA-4850-B859-D69C80F37FFC"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88C40692-FE9F-48D6-9AEB-5F35FA369980"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.5:-:win32:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "585F51C8-2FDC-46CE-9F71-ED9EE2ADA472"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18395DAB-24DA-4ABD-ABD8-38A49417B052"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6228E3FF-5EB4-4F46-9EA8-1B114947994D"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96DEF388-2B09-4212-8AF5-9FE54CCAFEC8"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A798490-741B-4EB4-B1D9-353A181A7AA2"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.1:windows:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F781A379-57DF-4D1E-8B85-4FD637E4B967"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8466E9BD-5623-40EE-A604-0F29C3520B63"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E98B61C-7093-4251-B1D8-59B647C2DF6B"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F9FCAC0-08D1-4044-A506-4AC14BF381CA"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "545E4C50-229D-4B27-9DB2-9D1204451A9E"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D50A16A8-9C96-47CB-B18B-AE79C754ABBC"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08877372-B7DD-4543-84A8-C40D2BA100F1"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7135BE6C-E797-4C41-BCD5-161DC7561433"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E909F1D4-AFB1-43F3-9635-E318D64099B4"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB4AAE4C-3F59-46D3-A38E-CC5DFCBEC3DF"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "688CDCA9-2809-4C0E-9DBC-133F48D56BEA"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "564B521B-3C7C-46CF-94E8-A368AF81DA54"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC04BFA0-C7B0-4F70-9676-8156C9CE18AE"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.90:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F43CE80-06BC-4448-9033-F2F88663C527"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.91:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7181202-BC32-4F1E-9EF8-F544CCDA1671"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.92:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F55827F8-CC36-45DA-8F9E-1F520911EB12"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.3.93:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCEAA5DF-33D1-4D4A-BA01-4BC863DBC272"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "365FF476-1FFD-4E09-900C-50E0660766AB"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28374619-966D-4F38-B83E-A6296F27CC05"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22A28CDF-F2AF-4D49-9FB1-AED34A758289"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6399A22D-90DF-4CB5-9367-0C5242BD1A2B"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D63B0B4A-3998-4A4F-AD7A-BB8CEBE897B9"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDA6934A-3D02-4749-A147-BE538C0AF27F"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B238CA5-3B4D-4D6A-92CA-39A7CD57AF40"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC6150E3-1D7C-44DA-BA57-35AB26F881B1"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EB20A34-5E11-4D70-B3DE-66DD9863AE0D"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA47467D-3D96-46DB-B0AC-D28586829710"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68B68F2F-0718-4C87-9629-4657DC49EECC"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69D492F9-2064-488A-BD16-99DD865D2BF6"
},
{
"criteria": "cpe:2.3:a:gnupg:gnupg:1.4.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4929286-63C2-45D0-B0C7-E14438D82883"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}