---

CVE-2018-0495 - log back

CVE-2018-0495 created at 25 Sep 2019 19:31:40
Severity	+ High
Remote	+ Local
Type	+ Private key recovery
Description	+ An implementation flaw has been discovered in multiple cryptographic libraries that allows a side-channel based attacker to recover ECDSA or DSA private keys. When these cryptographic libraries use the private key to create a signature, such as for a TLS or SSH connection, they inadvertently leak information through memory caches. An unprivileged attacker running on the same machine can collect the information from a few thousand signatures and recover the value of the private key.
References	+ https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=9010d1576e278a4274ad3f4aa15776c28f6ba965;hp=7b6c2afd699e889f5f054cc3d202a61bd0ee1dcf + https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html + https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/
Notes