{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "ElGamal implementation allows plaintext recovery",
    "tracking": {
      "current_release_date": "2026-07-21T00:27:42+00:00",
      "generator": {
        "date": "2026-07-21T00:27:42+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.1.0"
        }
      },
      "id": "CVE-2021-40528",
      "initial_release_date": "2021-07-20T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T00:27:42+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6-els",
            "product": {
              "name": "Red Hat Enterprise Linux 6-els",
              "product_id": "rhel-6-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 7-els",
            "product": {
              "name": "Red Hat Enterprise Linux 7-els",
              "product_id": "rhel-7-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:7"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 8.6.0.z",
            "product": {
              "name": "Red Hat Enterprise Linux 8.6.0.z",
              "product_id": "rhel-8.6.0.z.eus::baseos",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_eus:8.6::baseos"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 8.7",
            "product": {
              "name": "Red Hat Enterprise Linux 8.7",
              "product_id": "rhel-8.7.0",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:8"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 9.0",
            "product": {
              "name": "Red Hat Enterprise Linux 9.0",
              "product_id": "rhel-9.0",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:9"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 8.6.0.z",
            "product": {
              "name": "Red Hat Enterprise Linux 8.6.0.z",
              "product_id": "rhel-br-8.6.0.z::baseos",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt",
            "product": {
              "name": "libgcrypt",
              "product_id": "libgcrypt",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt",
            "product": {
              "name": "libgcrypt",
              "product_id": "libgcrypt-0:1.8.5-7.el8_6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt",
            "product": {
              "name": "libgcrypt",
              "product_id": "libgcrypt-0:1.8.5-7.el8_6.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=src&epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt-debuginfo",
            "product": {
              "name": "libgcrypt-debuginfo",
              "product_id": "libgcrypt-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt-debugsource",
            "product": {
              "name": "libgcrypt-debugsource",
              "product_id": "libgcrypt-debugsource",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt-debugsource"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt-devel",
            "product": {
              "name": "libgcrypt-devel",
              "product_id": "libgcrypt-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt-devel-debuginfo",
            "product": {
              "name": "libgcrypt-devel-debuginfo",
              "product_id": "libgcrypt-devel-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt-devel-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "libgcrypt",
            "product": {
              "name": "libgcrypt",
              "product_id": "libgcrypt.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/libgcrypt?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libgcrypt"
        },
        "product_reference": "libgcrypt",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libgcrypt"
        },
        "product_reference": "libgcrypt",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.8.5-7.el8_6 as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6"
        },
        "product_reference": "libgcrypt-0:1.8.5-7.el8_6",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.8.5-7.el8_6 as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6"
        },
        "product_reference": "libgcrypt-0:1.8.5-7.el8_6",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.8.5-7.el8_6.src as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6.src"
        },
        "product_reference": "libgcrypt-0:1.8.5-7.el8_6.src",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-0:1.8.5-7.el8_6.src as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6.src"
        },
        "product_reference": "libgcrypt-0:1.8.5-7.el8_6.src",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debuginfo as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libgcrypt-debuginfo"
        },
        "product_reference": "libgcrypt-debuginfo",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debuginfo as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libgcrypt-debuginfo"
        },
        "product_reference": "libgcrypt-debuginfo",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debuginfo as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-debuginfo"
        },
        "product_reference": "libgcrypt-debuginfo",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debuginfo as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-debuginfo"
        },
        "product_reference": "libgcrypt-debuginfo",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debugsource as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-debugsource"
        },
        "product_reference": "libgcrypt-debugsource",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-debugsource as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-debugsource"
        },
        "product_reference": "libgcrypt-debugsource",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libgcrypt-devel"
        },
        "product_reference": "libgcrypt-devel",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libgcrypt-devel"
        },
        "product_reference": "libgcrypt-devel",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-devel"
        },
        "product_reference": "libgcrypt-devel",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel as a component of Red Hat Enterprise Linux 9.0",
          "product_id": "rhel-9.0:libgcrypt-devel"
        },
        "product_reference": "libgcrypt-devel",
        "relates_to_product_reference": "rhel-9.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-devel"
        },
        "product_reference": "libgcrypt-devel",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-debuginfo as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-br-8.6.0.z::baseos:libgcrypt-devel-debuginfo"
        },
        "product_reference": "libgcrypt-devel-debuginfo",
        "relates_to_product_reference": "rhel-br-8.6.0.z::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt-devel-debuginfo as a component of Red Hat Enterprise Linux 8.6.0.z",
          "product_id": "rhel-8.6.0.z.eus::baseos:libgcrypt-devel-debuginfo"
        },
        "product_reference": "libgcrypt-devel-debuginfo",
        "relates_to_product_reference": "rhel-8.6.0.z.eus::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt.src as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:libgcrypt.src"
        },
        "product_reference": "libgcrypt.src",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt.src as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:libgcrypt.src"
        },
        "product_reference": "libgcrypt.src",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt.src as a component of Red Hat Enterprise Linux 8.7",
          "product_id": "rhel-8.7.0:libgcrypt.src"
        },
        "product_reference": "libgcrypt.src",
        "relates_to_product_reference": "rhel-8.7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libgcrypt.src as a component of Red Hat Enterprise Linux 9.0",
          "product_id": "rhel-9.0:libgcrypt.src"
        },
        "product_reference": "libgcrypt.src",
        "relates_to_product_reference": "rhel-9.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-40528",
      "discovery_date": "2021-09-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-6-els.els:libgcrypt-debuginfo",
            "rhel-6-els.els:libgcrypt-devel",
            "rhel-7-els.els:libgcrypt-debuginfo",
            "rhel-7-els.els:libgcrypt-devel",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debuginfo",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debugsource",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel-debuginfo",
            "rhel-9.0:libgcrypt-devel",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debuginfo",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debugsource",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel-debuginfo"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Please note that there was a mixup between this CVE and CVE-2021-33560. At this time, both CVEs should be assumed to refer to the same issue. More information will be provided in the near future. See the first link in External References for more information.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A flaw was found in libgcrypt's ElGamal implementation, where it allows plain text recovery. During the interaction between two cryptographic libraries, a certain combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6",
          "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
          "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6",
          "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6.src"
        ],
        "known_affected": [
          "rhel-6-els.els:libgcrypt",
          "rhel-6-els.els:libgcrypt.src",
          "rhel-7-els.els:libgcrypt",
          "rhel-7-els.els:libgcrypt.src",
          "rhel-8.7.0:libgcrypt.src",
          "rhel-9.0:libgcrypt.src"
        ],
        "known_not_affected": [
          "rhel-6-els.els:libgcrypt-debuginfo",
          "rhel-6-els.els:libgcrypt-devel",
          "rhel-7-els.els:libgcrypt-debuginfo",
          "rhel-7-els.els:libgcrypt-devel",
          "rhel-8.6.0.z.eus::baseos:libgcrypt-debuginfo",
          "rhel-8.6.0.z.eus::baseos:libgcrypt-debugsource",
          "rhel-8.6.0.z.eus::baseos:libgcrypt-devel",
          "rhel-8.6.0.z.eus::baseos:libgcrypt-devel-debuginfo",
          "rhel-9.0:libgcrypt-devel",
          "rhel-br-8.6.0.z::baseos:libgcrypt-debuginfo",
          "rhel-br-8.6.0.z::baseos:libgcrypt-debugsource",
          "rhel-br-8.6.0.z::baseos:libgcrypt-devel",
          "rhel-br-8.6.0.z::baseos:libgcrypt-devel-debuginfo"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-40528"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40528"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-40528"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "rhel-6-els.els:libgcrypt",
            "rhel-6-els.els:libgcrypt.src",
            "rhel-7-els.els:libgcrypt",
            "rhel-7-els.els:libgcrypt.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "rhel-8.7.0:libgcrypt.src",
            "rhel-9.0:libgcrypt.src"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2022-06-30T21:05:49+00:00",
          "details": "Apply advisory RHSA-2022:5311 as per vendors instructions.",
          "product_ids": [
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6.src"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2022:5311"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM"
          },
          "products": [
            "rhel-6-els.els:libgcrypt",
            "rhel-6-els.els:libgcrypt-debuginfo",
            "rhel-6-els.els:libgcrypt-devel",
            "rhel-6-els.els:libgcrypt.src",
            "rhel-7-els.els:libgcrypt",
            "rhel-7-els.els:libgcrypt-debuginfo",
            "rhel-7-els.els:libgcrypt-devel",
            "rhel-7-els.els:libgcrypt.src",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debuginfo",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debugsource",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel-debuginfo",
            "rhel-8.7.0:libgcrypt.src",
            "rhel-9.0:libgcrypt-devel",
            "rhel-9.0:libgcrypt.src",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debuginfo",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debugsource",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel-debuginfo"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhel-6-els.els:libgcrypt",
            "rhel-6-els.els:libgcrypt-debuginfo",
            "rhel-6-els.els:libgcrypt-devel",
            "rhel-6-els.els:libgcrypt.src",
            "rhel-7-els.els:libgcrypt",
            "rhel-7-els.els:libgcrypt-debuginfo",
            "rhel-7-els.els:libgcrypt-devel",
            "rhel-7-els.els:libgcrypt.src",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debuginfo",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-debugsource",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel",
            "rhel-8.6.0.z.eus::baseos:libgcrypt-devel-debuginfo",
            "rhel-8.7.0:libgcrypt.src",
            "rhel-9.0:libgcrypt-devel",
            "rhel-9.0:libgcrypt.src",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6",
            "rhel-br-8.6.0.z::baseos:libgcrypt-0:1.8.5-7.el8_6.src",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debuginfo",
            "rhel-br-8.6.0.z::baseos:libgcrypt-debugsource",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel",
            "rhel-br-8.6.0.z::baseos:libgcrypt-devel-debuginfo"
          ]
        }
      ],
      "title": "ElGamal implementation allows plaintext recovery"
    }
  ]
}