Ubuntu alert USN-8711-1 (libgcrypt20)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8711-1] Libgcrypt vulnerability
Date:
             
 
Tue, 01 Sep 2026 17:36:25 +0000
Message-ID:
             
 
<E1x1SPJ-0007I5-NR@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8711-1
September 01, 2026

libgcrypt20 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Libgcrypt could be made to expose sensitive information over the network.

Software Description:
- libgcrypt20: LGPL Crypto library

Details:

It was discovered that Libgcrypt had a timing-based side-channel flaw in
its RSA implementation. A remote attacker could possibly use this issue to
obtain sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libgcrypt20                     1.12.0-2ubuntu1.1

Ubuntu 24.04 LTS
  libgcrypt20                     1.10.3-2ubuntu0.2

Ubuntu 22.04 LTS
  libgcrypt20                     1.9.4-3ubuntu3.3

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8711-1
  CVE-2024-2236

Package Information:
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.12.0-2...
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.10.3-2...
  https://launchpad.net/ubuntu/+source/libgcrypt20/1.9.4-3u...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqXDLcACgkQcpJm3tlz
hgFHlw/+OkXzKMGhQvxeH0tP1suWk3XAXk6J3BNT7pOUE8v6sC5YxfOSpu6rxXjc
hpF9D3/9foYkduWW6Q3gSI08P5ywn26f7Arj7tzitxigU5quy9Kc8MoE8UdkuWWI
j2wmQHemuClxAzbR3A9a15xGp/O63gsSy4YxshMpgsBRQRlwgGupdC8dz5jnNFnz
7tUx23pI0fhYVCDN5OnCzsO1kwgqkxNAJBOXHtOgugwQOeZzFJwX/bOj2jymWQTj
QjGqpeuaewDwqJmcWgHygSzukvS+sXjMDMJZyqVmYaCin0XhzuwmwoynUNTUKeo7
I8YTp/uQTAl74fGfWfP+YUj4qyuCDlOe+k11w7Pb0k/B4M2RjzzibTUJhwh1GgnH
kTt0q3XmCgcd12TMuiMijW4bMXwx+HTyTCuHXOGYf5jxfaoKIg/ukPPfRY0HymZ4
lsjP5uZVOyoxQ5JaMLv7MD+ICkYCcgkcca+iYAzgb4Bgt2bRd3levaEE54s83LZx
lzx8BCzMJOaP7pC6EslEzuqGBbtlD9C/lXsGgFxYC6pzsivQ5E4RCbngNanQImTs
gkwtoC/I2X5Rjre1NN11LC+X7yOIDhqlFqPuDI9/6rUSFUa747U/lmDiwQiD6hHQ
1uzOzZ8FesJn5XB4urh66EWsUz6XRnwR3J6jG1sWJnqb2Ax8EzE=
=EISE
-----END PGP SIGNATURE-----