CVE-2019-13627: Canonical Ubuntu Linux

Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days.

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only; version 19.10 only
• LIBGCRYPT20 Project LIBGCRYPT20: version 1.6.3-2+deb8u4 only; version 1.7.6-2+deb9u3 only; version 1.8.4-5 only
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-09-25. Last modified 2026-06-17.