Ubuntu alert USN-8319-1 (libgcrypt20)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8319-1] Libgcrypt vulnerabilities
Date:
             
 
Wed, 27 May 2026 13:38:01 +0000
Message-ID:
             
 
<E1wSESP-0005pJ-PK@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8319-1
May 27, 2026

libgcrypt20 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in Libgcrypt.

Software Description:
- libgcrypt20: LGPL Crypto library

Details:

It was discovered that Libgcrypt incorrectly handled crafted ECDH
ciphertext. An attacker could possibly use this issue to cause Libgcrypt to
crash, resulting in a denial of service. (CVE-2026-41989)

It was discovered that Libgcrypt incorrectly handled Dilithium signing. An
attacker could possibly use this issue to cause Libgcrypt to crash,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS. (CVE-2026-41990)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libgcrypt20                     1.12.0-2ubuntu0.1

Ubuntu 25.10
  libgcrypt20                     1.11.0-7ubuntu0.1

Ubuntu 24.04 LTS
  libgcrypt20                     1.10.3-2ubuntu0.1

Ubuntu 22.04 LTS
  libgcrypt20                     1.9.4-3ubuntu3.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8319-1
  CVE-2026-41989, CVE-2026-41990

Package Information:
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.12.0-2...
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.11.0-7...
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.10.3-2...
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.9.4-3u...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoW830ACgkQcpJm3tlz
hgGNixAAlVMO6AxX7/GF1iQBYfBnCa705KXWlMV1r8M/R6SET01oCDS8aHz49TwY
bH7r0RytwMavjzgbT9lYi8x8e562AgLShBHJlTd/iPwOtCoVeAXU2xt/b1XCblFG
uzJd6ra+y9GhFBA1mjv6b5dgyJXOrOultXd8P0OsFX5S4X27O4cvVhH2bnw4Gzzi
NEyqHKmM7LtAzfmSp1Co7VcowoZ84OFZdFrxsngwjgGW1IAtKm463x2La5BRSRYn
Cwfd0yY5rqVFDNn2QhHkf951pbrIwQIGigbpj8WbuWYl8UfW9B/OBtEEUd6pqr/J
e2ZlRGVJlSOTy+uUfWUn7/NMwe18LJciS+Br1l9QgsqdrMIquXen3206YeeJVaDB
UaFngvSF3CgR5YqiAYIIdLH5yLFYjArAFlmWwWHEd+pHF2wkswBJQ4K3k492t3/5
I6heKV/xdgMgMlrug6+PMQYY1s3K+Qw32oIu1dWTJN0VKuPIU1Q7m4Q+uu/7/dv1
2Nc1im+7B7ZnC4Ekws8ELJqACYNzw2TOxHbv7QHq2xI2mWJ36SSbA8sKXDlKBGQg
mztsO/+e3oGk2hFQhP33JFxVN3sLMu4sscsTBQlL8TwF5UMksgPuteClz7P511JQ
zktRPZuC9TVy49upHNRfQTkzHC/WSarwL8sKHwr893E+l15uZqg=
=azGG
-----END PGP SIGNATURE-----