{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/vex/2018/cve-2018-0495-els_os-centos6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-28T10:57:31Z",
      "generator": {
        "date": "2026-10-28T10:57:31Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2018-0495-ELS_OS-CENTOS6ELS",
      "initial_release_date": "2018-06-13T23:29:00Z",
      "revision_history": [
        {
          "date": "2018-06-13T23:29:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-28T10:57:31Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2018-0495"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Community Enterprise Operating System 6",
                "product": {
                  "name": "Community Enterprise Operating System 6",
                  "product_id": "CentOS-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Community Enterprise Operating System"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgcrypt-0:1.4.5-12.el6_8.i686",
                "product": {
                  "name": "libgcrypt-0:1.4.5-12.el6_8.i686",
                  "product_id": "libgcrypt-0:1.4.5-12.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/libgcrypt@1.4.5-12.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgcrypt-devel-0:1.4.5-12.el6_8.i686",
                "product": {
                  "name": "libgcrypt-devel-0:1.4.5-12.el6_8.i686",
                  "product_id": "libgcrypt-devel-0:1.4.5-12.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/libgcrypt-devel@1.4.5-12.el6_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgcrypt-0:1.4.5-12.el6_8.x86_64",
                "product": {
                  "name": "libgcrypt-0:1.4.5-12.el6_8.x86_64",
                  "product_id": "libgcrypt-0:1.4.5-12.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/libgcrypt@1.4.5-12.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgcrypt-devel-0:1.4.5-12.el6_8.x86_64",
                "product": {
                  "name": "libgcrypt-devel-0:1.4.5-12.el6_8.x86_64",
                  "product_id": "libgcrypt-devel-0:1.4.5-12.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/centos/libgcrypt-devel@1.4.5-12.el6_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                  "product_id": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libgcrypt@1.4.5-12.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                  "product_id": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libgcrypt-devel@1.4.5-12.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libgcrypt@1.4.5-12.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libgcrypt-devel@1.4.5-12.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.4.5-12.el6_8.i686 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.i686"
        },
        "product_reference": "libgcrypt-0:1.4.5-12.el6_8.i686",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.4.5-12.el6_8.x86_64 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.x86_64"
        },
        "product_reference": "libgcrypt-0:1.4.5-12.el6_8.x86_64",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-0:1.4.5-12.el6_8.x86_64 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.x86_64"
        },
        "product_reference": "libgcrypt-devel-0:1.4.5-12.el6_8.x86_64",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "CentOS-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-0:1.4.5-12.el6_8.i686 as a component of Community Enterprise Operating System 6",
          "product_id": "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.i686"
        },
        "product_reference": "libgcrypt-devel-0:1.4.5-12.el6_8.i686",
        "relates_to_product_reference": "CentOS-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-0495",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "description",
          "text": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.i686",
          "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
          "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
          "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.x86_64",
          "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.i686",
          "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
          "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
          "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2018-0495"
        },
        {
          "category": "external",
          "summary": "http://www.securitytracker.com/id/1041144",
          "url": "http://www.securitytracker.com/id/1041144"
        },
        {
          "category": "external",
          "summary": "http://www.securitytracker.com/id/1041147",
          "url": "http://www.securitytracker.com/id/1041147"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2018:3221",
          "url": "https://access.redhat.com/errata/RHSA-2018:3221"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2018:3505",
          "url": "https://access.redhat.com/errata/RHSA-2018:3505"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2019:1296",
          "url": "https://access.redhat.com/errata/RHSA-2019:1296"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2019:1297",
          "url": "https://access.redhat.com/errata/RHSA-2019:1297"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2019:1543",
          "url": "https://access.redhat.com/errata/RHSA-2019:1543"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2019:2237",
          "url": "https://access.redhat.com/errata/RHSA-2019:2237"
        },
        {
          "category": "external",
          "summary": "https://dev.gnupg.org/T4011",
          "url": "https://dev.gnupg.org/T4011"
        },
        {
          "category": "external",
          "summary": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html"
        },
        {
          "category": "external",
          "summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3689-1/",
          "url": "https://usn.ubuntu.com/3689-1/"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3689-2/",
          "url": "https://usn.ubuntu.com/3689-2/"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3692-1/",
          "url": "https://usn.ubuntu.com/3692-1/"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3692-2/",
          "url": "https://usn.ubuntu.com/3692-2/"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3850-1/",
          "url": "https://usn.ubuntu.com/3850-1/"
        },
        {
          "category": "external",
          "summary": "https://usn.ubuntu.com/3850-2/",
          "url": "https://usn.ubuntu.com/3850-2/"
        },
        {
          "category": "external",
          "summary": "https://www.debian.org/security/2018/dsa-4231",
          "url": "https://www.debian.org/security/2018/dsa-4231"
        },
        {
          "category": "external",
          "summary": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "url": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "category": "external",
          "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
        }
      ],
      "release_date": "2018-06-13T23:29:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T15:18:40.639341Z",
          "details": "CVE-2018-0495 is a cache-timing side channel limited to ECDSA signing in libgcrypt versions prior to 1.7.10/1.8.3; verification and other algorithms are unaffected. Exploitation requires executing code on the target host or a strictly co-resident VM and collecting many signatures from the same long‑lived ECDSA key with precise timing, and it yields no code execution or privilege escalation on its own. Given the local, high‑complexity nature and narrow preconditions (outdated library and an active ECDSA-signing workload), this can be safely deprioritized for managed enterprise VM/server deployments.",
          "product_ids": [
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.i686",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.x86_64",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.i686",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.i686",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.i686",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
            "CentOS-6:libgcrypt-0:1.4.5-12.el6_8.x86_64",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.i686",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.i686",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.tuxcare.els1.x86_64",
            "CentOS-6:libgcrypt-devel-0:1.4.5-12.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}