Plaintext Recovery Vulnerability in Libgcrypt Affects OpenPGP Implementations

CVE-2021-40528

What is CVE-2021-40528?

The ElGamal implementation in Libgcrypt prior to version 1.9.4 is susceptible to a vulnerability that allows plaintext recovery. During interactions between cryptographic libraries, a specific combination of parameters—including the prime and generator defined by the receiver's public key, as well as the sender's ephemeral exponents—can lead to a cross-configuration attack against OpenPGP. This can potentially expose sensitive plaintext data, compromising the integrity and confidentiality of cryptographic operations.

References