CVE-2014-3591: Debian Linux

Medium severity, CVSS 4.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only
• Gnupg Gnupg: before 1.4.19 (fixed in 1.4.19)
• Gnupg Libgcrypt: before 1.6.3 (fixed in 1.6.3)

Published 2019-11-29. Last modified 2026-06-17.