ALAS-2016-744


Amazon Linux AMI Security Advisory: ALAS-2016-744
Advisory Release Date: 2016-09-15 19:00 Pacific
Severity: Medium
References: CVE-2016-6313 

Issue Overview:

A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker who can obtain the first 580 bytes of the PRNG output can trivially predict the following 20 bytes.


Affected Packages:

libgcrypt,gnupg


Issue Correction:
Run yum update libgcrypt to update your system.
Run yum update gnupg to update your system.

New Packages:
i686:
    libgcrypt-devel-1.5.3-12.19.amzn1.i686
    libgcrypt-1.5.3-12.19.amzn1.i686
    libgcrypt-debuginfo-1.5.3-12.19.amzn1.i686
    gnupg-debuginfo-1.4.19-1.28.amzn1.i686
    gnupg-1.4.19-1.28.amzn1.i686

src:
    libgcrypt-1.5.3-12.19.amzn1.src
    gnupg-1.4.19-1.28.amzn1.src

x86_64:
    libgcrypt-devel-1.5.3-12.19.amzn1.x86_64
    libgcrypt-1.5.3-12.19.amzn1.x86_64
    libgcrypt-debuginfo-1.5.3-12.19.amzn1.x86_64
    gnupg-debuginfo-1.4.19-1.28.amzn1.x86_64
    gnupg-1.4.19-1.28.amzn1.x86_64