{"cve":{"cve_id":"CVE-2018-0495","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00887,"epss_percentile":0.58499,"epss_as_of":"2026-10-15","description":"Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.","published_at":"2018-06-13T23:00:00Z","last_modified_at":"2026-10-14T07:16:41.650000Z","cvss_v3_score":4.7,"cvss_v3_vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_v3_severity":"MEDIUM","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-203"],"nvd_references":["https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965","http://www.securitytracker.com/id/1041144","https://usn.ubuntu.com/3850-1/","http://www.securitytracker.com/id/1041147","https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/","https://usn.ubuntu.com/3689-1/","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html","https://usn.ubuntu.com/3689-2/","https://usn.ubuntu.com/3692-2/","https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html","https://www.debian.org/security/2018/dsa-4231","https://access.redhat.com/errata/RHSA-2018:3505","https://usn.ubuntu.com/3850-2/","https://usn.ubuntu.com/3692-1/","https://access.redhat.com/errata/RHSA-2018:3221","https://dev.gnupg.org/T4011","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2019:2237"],"vuln_status":"Modified","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-10-15T05:09:40.223577Z"},"effective_severity":"MEDIUM","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.0","metrics":[{"metric":"AV","name":"Attack Vector","value":"L","value_label":"Local"},{"metric":"AC","name":"Attack Complexity","value":"H","value_label":"High"},{"metric":"PR","name":"Privileges Required","value":"L","value_label":"Low"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"18.10","version_start_inclusive":true,"version_end":"18.10","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"},{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"12.04","version_start_inclusive":true,"version_end":"12.04","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*"},{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"14.04","version_start_inclusive":true,"version_end":"14.04","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*"},{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"16.04","version_start_inclusive":true,"version_end":"16.04","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"},{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"17.10","version_start_inclusive":true,"version_end":"17.10","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"},{"vendor_slug":"canonical","vendor_name":"canonical","product_slug":"ubuntu-linux","product_name":"Ubuntu Linux","version_start":"18.04","version_start_inclusive":true,"version_end":"18.04","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"},{"vendor_slug":"debian","vendor_name":"Debian","product_slug":"debian-linux","product_name":"debian_linux","version_start":"8.0","version_start_inclusive":true,"version_end":"8.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"vendor_slug":"debian","vendor_name":"Debian","product_slug":"debian-linux","product_name":"debian_linux","version_start":"9.0","version_start_inclusive":true,"version_end":"9.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"vendor_slug":"gnupg","vendor_name":"GnuPG","product_slug":"libgcrypt","product_name":"Libgcrypt","version_start":null,"version_start_inclusive":null,"version_end":"1.7.10","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"traffic-director","product_name":"traffic_director","version_start":"11.1.1.9.0","version_start_inclusive":true,"version_end":"11.1.1.9.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:traffic_director:11.1.1.9.0:*:*:*:*:*:*:*"},{"vendor_slug":"redhat","vendor_name":"redhat","product_slug":"ansible-tower","product_name":"ansible_tower","version_start":"3.3","version_start_inclusive":true,"version_end":"3.3","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*"},{"vendor_slug":"redhat","vendor_name":"redhat","product_slug":"enterprise-linux-desktop","product_name":"enterprise_linux_desktop","version_start":"7.0","version_start_inclusive":true,"version_end":"7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"},{"vendor_slug":"redhat","vendor_name":"redhat","product_slug":"enterprise-linux-server","product_name":"enterprise_linux_server","version_start":"7.0","version_start_inclusive":true,"version_end":"7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"},{"vendor_slug":"redhat","vendor_name":"redhat","product_slug":"enterprise-linux-workstation","product_name":"enterprise_linux_workstation","version_start":"7.0","version_start_inclusive":true,"version_end":"7.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"}],"exploit_refs":[],"news":[],"references":[{"url":"https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965","source_type":"MISC","tags":[]},{"url":"http://www.securitytracker.com/id/1041144","source_type":"MISC","tags":[]},{"url":"https://usn.ubuntu.com/3850-1/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"http://www.securitytracker.com/id/1041147","source_type":"MISC","tags":[]},{"url":"https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/","source_type":"MISC","tags":[]},{"url":"https://usn.ubuntu.com/3689-1/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"https://usn.ubuntu.com/3689-2/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://usn.ubuntu.com/3692-2/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html","source_type":"MAILING_LIST","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2018/dsa-4231","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://usn.ubuntu.com/3850-2/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://usn.ubuntu.com/3692-1/","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3221","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://dev.gnupg.org/T4011","source_type":"MISC","tags":[]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1297","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1296","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1543","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2237","source_type":"VENDOR_ADVISORY","tags":["advisory"]}],"timeline":[{"type":"published","at":"2018-06-13T23:00:00Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-10-14T23:59:09.254433Z","label":"CVSS score revised","source":"nvd"},{"type":"cvss_changed","at":"2026-10-14T23:59:09.254433Z","label":"CVSS score revised","source":"nvd"},{"type":"cvss_changed","at":"2026-10-14T23:59:09.254433Z","label":"CVSS score revised","source":"nvd"}]}