CVE-2017-7526

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

Metrics

CVSS 3.0 6.8/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-310

Affected software

VendorProductVersions
GnuPGlibgcrypt1.7.8

References

Timeline

Published
Jul 26, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-75286.5Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For headCVE-2017-75297.5Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultinCVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitCVE-2017-75314.3In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-75326.5In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-75337.0Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of CVE-2017-75345.4OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user inCVE-2017-75356.1foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user CVE-2017-75367.0In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whiCVE-2017-75377.5It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package beforCVE-2017-75385.4A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an orCVE-2017-75397.5An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where
CVE-2017-7526: Medium severity, CVSS 6.8 | Vulnix