© 2026 vulntracker.io

CVE-2021-33560

HIGH

7.5

CVSS Score

Published: June 8, 2021 at 12:00 AM UTC

Updated: October 14, 2026 at 12:17 PM UTC

9 products affected across 5 vendorsDebian LinuxFedoraCommunications Cloud Native Core Binding Support Function

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

Fedora · Fedora Projectrpm

95%

Libgcrypt · Gnupg

95%

v < 1.8.81.9.0 ≤ v < 1.9.3

Affected range stops below 1.8.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.9.3, so it looks safe — our inference, not a vendor statement

Communications Cloud Native Core Binding Support Function · Oracle

95%

Communications Cloud Native Core Network Function Cloud Native Environment · Oracle

95%

Communications Cloud Native Core Network Repository Function · Oracle

95%

1.14.0 1.15.0 1.15.1

Communications Cloud Native Core Network Slice Selection Function · Oracle

95%

Communications Cloud Native Core Service Communication Proxy · Oracle

95%

Libgcrypt · Gnu

72%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (13)

Release NotesVendor Advisory

Source: [email protected]

https://dev.gnupg.org/T5305

Vendor Advisory

Source: [email protected]

https://dev.gnupg.org/T5328

Release NotesVendor Advisory

Source: [email protected]

https://dev.gnupg.org/T5466

PatchVendor Advisory

Source: [email protected]

https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61

Mailing ListThird Party Advisory

Source: [email protected]

https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html

Vendor Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/

Vendor Advisory

Source: [email protected]

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/

Vendor AdvisoryThird Party Advisory

Source: [email protected]

https://security.gentoo.org/glsa/202210-13

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-203CWE-325

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card