CVE-2021-40530 Weak cryptography in n/a

What is CVE-2021-40530?

CVE-2021-40530 is a medium-severity vulnerability in Fedoraproject Fedora, published on 6 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Weakness: CWE-327

Which versions are affected by CVE-2021-40530?

It affects 2 products.

Products include Cryptopp Crypto\+\+, Fedoraproject Fedora.

How do I fix CVE-2021-40530?

Upgrade to a fixed version.

Is CVE-2021-40530 being exploited?

There is no known exploitation of CVE-2021-40530 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2023-50980 Denial of service in n/a High 7.5
• CVE-2023-50981 Denial of service in n/a High 7.5
• CVE-2022-48570 Information disclosure in n/a High 7.5
• CVE-2016-3995 Information disclosure in n/a High 7.5
• CVE-2016-7544 Use after free in n/a High 7.5

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-40530, GHSA-p3r9-6fhw-hgv8, MGASA-2021-0468, UBUNTU-CVE-2021-40530.