Skip to content
Fencer Intel
medium 4.7

CVE-2018-0495 json

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through…

published 2018-06-13 8 y ago modified 2026-10-14 26 d ago also EUVD-2018-1318

cvss
4.7
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • libgcrypt20 Debian 14, Debian 13, Debian 12 1.8.3-1

debian advisories DEBIAN-CVE-2018-0495

  • nss Ubuntu 14.04 LTS 2:3.28.4-0ubuntu0.14.04.4
  • nss Ubuntu 16.04 LTS 2:3.28.4-0ubuntu0.16.04.4
  • nss Ubuntu 18.04 LTS 2:3.35-2ubuntu2.1
  • openssl Ubuntu 14.04 LTS 1.0.1f-1ubuntu2.26
  • openssl Ubuntu 16.04 LTS 1.0.2g-1ubuntu4.13
  • openssl Ubuntu 18.04 LTS 1.1.0g-2ubuntu4.1
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.1
  • libgcrypt11 Ubuntu 14.04 LTS 1.5.3-2ubuntu4.6

ubuntu advisories UBUNTU-CVE-2018-0495

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nspr RHEL 7 4.21.0-1.el7
  • nss RHEL 7 3.44.0-4.el7
  • nss-util RHEL 7 3.44.0-3.el7
  • nss-tools RHEL 7 3.44.0-4.el7
  • nss-softokn RHEL 7 3.44.0-5.el7
  • nss-sysinit RHEL 7 3.44.0-4.el7
  • nss-softokn-freebl RHEL 7 3.44.0-5.el7
  • openssl RHEL 7 1:1.0.2k-16.el7

red hat advisories RHSA-2020:1461RHSA-2020:1345RHSA-2020:1267RHSA-2019:2237RHSA-2018:3221RHSA-2019:1297

  • mozilla-nss SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 3.40.1-58.18.1
  • mozilla-nspr SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 4.20-19.6.1
  • MozillaFirefox SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +13 more 60.4.0esr-109.55.1
  • mozilla-nss SLE Module for Basesystem 15 3.40.1-3.7.2
  • mozilla-nspr SLE Module for Basesystem 15 4.20-3.3.2
  • MozillaFirefox SLE Module for Desktop Applications 15 60.4.0-3.21.1
  • libgcrypt SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4 +5 more 1.6.1-16.62.1
  • libgcrypt SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 1.6.1-16.55.1

suse advisories SUSE-SU-2018:4236-2SUSE-SU-2018:4236-1SUSE-SU-2018:4235-1SUSE-SU-2018:2452-2SUSE-SU-2018:2089-1SUSE-SU-2018:1993-1

  • libgcrypt openSUSE Tumbleweed 1.9.4-1.2
  • mozilla-nss openSUSE Tumbleweed 3.69.1-1.2

opensuse advisories openSUSE-SU-2024:10941-1openSUSE-SU-2024:11058-1

  • libressl Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 2.7.4-r0
  • libressl Alpine 3.7 2.6.5-r0
  • libgcrypt Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 1.8.3-r0
  • libgcrypt Alpine 3.6, Alpine 3.5 1.7.10-r0

alpine advisories ALPINE-CVE-2018-0495

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libgcrypt Arch Linux 1.8.3-1

arch linux advisories AVG-719

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-0495 updated cvss 5.1

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

  • Red Hat CloudForms Management Engine 5 libtomcrypt Red Hat Enterprise Linux 5 nss, openssl, openssl097a Red Hat Enterprise Linux 6 nss, openssl, nss-tools, nss-sysinit, openssl098e, openssl-perl Red Hat Enterprise Linux 7 OVMF, openssl098e
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 5 openssl
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Enterprise Web Server 2 openssl
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3 openssl
    affected: no fix available
  • Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2
    fixed: vendor fix RHSA-2019:1543
  • Red Hat Ansible Tower 3.4 for RHEL 7 Server ansible-tower-34/ansible-tower-memcached 1.4.15-28, ansible-tower-35/ansible-tower-memcached 1.4.15-28, ansible-tower-37/ansible-tower-memcached-rhel7 1.4.15-28
    fixed: vendor fix RHBA-2020:0547
  • Red Hat Enterprise Linux Client (v. 7) nss 3.44.0-4.el7, nspr 4.21.0-1.el7, nss-util 3.44.0-3.el7, openssl 1.0.2k-16.el7, nss-tools 3.44.0-4.el7, nss-softokn 3.44.0-5.el7, +3 more Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux ComputeNode (v. 7) nss 3.44.0-4.el7, nspr 4.21.0-1.el7, nss-util 3.44.0-3.el7, openssl 1.0.2k-16.el7, nss-tools 3.44.0-4.el7, nss-softokn 3.44.0-5.el7, +3 more
    fixed: vendor fix RHSA-2018:3221
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) nss-softokn 3.36.0-6.el7_5, nss-softokn-freebl 3.36.0-6.el7_5
    fixed: vendor fix RHSA-2020:1267
show 13 more
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) nss-softokn 3.36.0-6.el7_6, nss-softokn-freebl 3.36.0-6.el7_6
    fixed: vendor fix RHSA-2020:1461
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-16.el7
    fixed: vendor fix RHSA-2018:3221
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) nss-softokn-devel 3.36.0-6.el7_5, nss-softokn-debuginfo 3.36.0-6.el7_5, nss-softokn-freebl-devel 3.36.0-6.el7_5
    fixed: vendor fix RHSA-2020:1267
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) nss-softokn-devel 3.36.0-6.el7_6, nss-softokn-debuginfo 3.36.0-6.el7_6, nss-softokn-freebl-devel 3.36.0-6.el7_6
    fixed: vendor fix RHSA-2020:1461
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl 1.0.2k-16.el7, nss-softokn 3.36.0-6.el7_6, openssl-libs 1.0.2k-16.el7, nss-softokn-freebl 3.36.0-6.el7_6 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux Server (v. 7) nss 3.44.0-4.el7, nspr 4.21.0-1.el7, nss-util 3.44.0-3.el7, openssl 1.0.2k-16.el7, nss-tools 3.44.0-4.el7, nss-softokn 3.44.0-5.el7, +3 more
    fixed: vendor fix RHSA-2018:3221
  • Red Hat Enterprise Linux Server AUS (v. 7.4) nss-softokn 3.28.3-9.el7_4, nss-softokn-freebl 3.28.3-9.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.4) nss-softokn 3.28.3-9.el7_4, nss-softokn-freebl 3.28.3-9.el7_4
    fixed: vendor fix RHSA-2020:1345
  • Red Hat Enterprise Linux Server EUS (v. 7.5) nss-softokn 3.36.0-6.el7_5, nss-softokn-freebl 3.36.0-6.el7_5
    fixed: vendor fix RHSA-2020:1267
  • Red Hat Enterprise Linux Server EUS (v. 7.6) nss-softokn 3.36.0-6.el7_6, nss-softokn-freebl 3.36.0-6.el7_6
    fixed: vendor fix RHSA-2020:1461
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-16.el7
    fixed: vendor fix RHSA-2018:3221
  • Red Hat Enterprise Linux Server TUS (v. 7.4) nss-softokn 3.28.3-9.el7_4, nss-softokn-freebl 3.28.3-9.el7_4
    fixed: vendor fix RHSA-2020:1345
  • Red Hat Enterprise Linux Workstation (v. 7) nss 3.44.0-4.el7, nspr 4.21.0-1.el7, nss-util 3.44.0-3.el7, openssl 1.0.2k-16.el7, nss-tools 3.44.0-4.el7, nss-softokn 3.44.0-5.el7, +3 more Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-16.el7
    fixed: vendor fix RHSA-2018:3221
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd 2.4.29-40.jbcs.el6, jbcs-httpd24-mod_ssl 2.4.29-40.jbcs.el6, jbcs-httpd24-openssl 1.0.2n-15.jbcs.el6, jbcs-httpd24-mod_ldap 2.4.29-40.jbcs.el6, jbcs-httpd24-httpd-tools 2.4.29-40.jbcs.el6, jbcs-httpd24-mod_session 2.4.29-40.jbcs.el6, +5 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.29-40.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.29-40.jbcs.el7, jbcs-httpd24-openssl 1.0.2n-15.jbcs.el7, jbcs-httpd24-mod_ldap 2.4.29-40.jbcs.el7, jbcs-httpd24-httpd-tools 2.4.29-40.jbcs.el7, jbcs-httpd24-mod_session 2.4.29-40.jbcs.el7, +5 more
    fixed: vendor fix RHSA-2019:1297
  • Red Hat Enterprise Linux 5 libgcrypt Red Hat Enterprise Linux 6 libgcrypt Red Hat Enterprise Linux 7 libgcrypt Red Hat Enterprise Linux 8 nss, openssl, nss-util, libgcrypt, nss-tools, nss-softokn, +4 more Red Hat JBoss Enterprise Application Platform 7 bouncycastle bouncycastle Red Hat Satellite 6 bouncycastle
    +2 more products
    Red Hat Subscription Asset Manager bouncycastle Red Hat Virtualization 4 bouncycastle, bouncycastle-pg, bouncycastle-tls, bouncycastle-mail, bouncycastle-pkix, bouncycastle-javadoc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 4.7

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • nccgroup.trust https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • n/a Libgcrypt before 1.7.10 and 1.8.x before 1.8.3
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.