CVE 2014-5270
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.
Related bugs and status
CVE-2014-5270 (Candidate) is related to these bugs:
Bug #1371766: Latest CVE-2014-5270 patch breaks ElGamal keys of 16k
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1371766 | Latest CVE-2014-5270 patch breaks ElGamal keys of 16k | gnupg (Ubuntu) | Undecided | Fix Released | ||
| 1371766 | Latest CVE-2014-5270 patch breaks ElGamal keys of 16k | gnupg (Debian) | Unknown | Fix Released | ||
Bug #1409117: GPG does not verify keys received when using --recv-keys leaving communicaiton with key servers vulnerable to MITM
Bug #1421640: "gpg2 --refresh-keys" results in "rejected by import filter"
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1421640 | "gpg2 --refresh-keys" results in "rejected by import filter" | gnupg2 (Ubuntu) | Undecided | Fix Released | ||
| 1421640 | "gpg2 --refresh-keys" results in "rejected by import filter" | gnupg2 (Ubuntu Vivid) | Undecided | Fix Released | ||
| 1421640 | "gpg2 --refresh-keys" results in "rejected by import filter" | gnupg2 (Ubuntu Utopic) | Undecided | Fix Released | ||
See the 
CVE page on Mitre.org
for more details.
