package/libgcrypt: security bump to version 1.9.3
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Mon, 21 Jun 2021 05:47:44 +0000 (07:47 +0200)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Sat, 3 Jul 2021 21:12:05 +0000 (23:12 +0200)
commit878b57ca3b80d63106ec1398932d2e0ebd18c0c7
treec29021c3bf7fd09be99fd2d8feea222b5fb95d16
parent7b1524beef11cddd66a39a195dab565cb4a7b317
package/libgcrypt: security bump to version 1.9.3

Fix CVE-2021-33560: Libgcrypt before 1.8.8 and 1.9.x before 1.9.3
mishandles ElGamal encryption because it lacks exponent blinding to
address a side-channel attack against mpi_powm, and the window size is
not chosen appropriately. (There is also an interoperability problem
because the selection of the k integer value does not properly consider
the differences between basic ElGamal encryption and generalized ElGamal
encryption.) This, for example, affects use of ElGamal in OpenPGP.

https://dev.gnupg.org/T5305

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/libgcrypt/libgcrypt.hash
package/libgcrypt/libgcrypt.mk