AZL-41702

    Dashboard / Vulnerabilities / AZL-41702

    AZL-41702

    Published: 26 Jul 2018Last Modified: 9 Sept 2026
    Upstream:
    CVE-2017-7526

    Summary: CVE-2017-7526 affecting package grub2 for versions less than 2.06-25

    Details: libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-7526

    Affected packages

    Package

    Name: grub2

    Purl: pkg:rpm/azure-linux/grub2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.06-25

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High