QSN-8711-1: Libgcrypt vulnerability
2026-09-01

Summary:
Libgcrypt could be made to expose sensitive information over the network.

Details:
It was discovered that Libgcrypt had a timing-based side-channel flaw in
its RSA implementation. A remote attacker could possibly use this issue to
obtain sensitive information.

Affected QuantaStor releases:
  6.9.1.001 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.9.0.464 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.6.015 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.5.018 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.4.038 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.3.018 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.2.002 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.1.007 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)
  6.8.0.205 jammy: libgcrypt20 1.9.4-3ubuntu3 (fixed in 1.9.4-3ubuntu3.3)

CVEs: CVE-2024-2236

References:
  https://ubuntu.com/security/notices/USN-8711-1