Cyber Resilience

CVE-2021-33560

High

Published: 08 June 2021

Published
08 June 2021
Modified
03 December 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0043 62.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-33560 is a high-severity Observable Discrepancy (CWE-203) vulnerability in Oracle Communications Cloud Native Core Network Repository Function. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 37.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CWE(s)
CWE-203CWE-325

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gnupg
libgcrypt
≤ 1.8.8 · 1.9.0 — 1.9.3
debian
debian linux
9.0
fedoraproject
fedora
33, 34
oracle
communications cloud native core binding support function
1.11.0
oracle
communications cloud native core network function cloud native environment
1.10.0, 1.9.0
oracle
communications cloud native core network repository function
1.14.0, 1.15.0, 1.15.1
oracle
communications cloud native core network slice selection function
1.8.0
oracle
communications cloud native core service communication proxy
1.15.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-30 Concealment and Misdirection
addresses: CWE-203

Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance.

SC-31 Covert Channel Analysis
addresses: CWE-203

Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues.

SI-11 Error Handling
addresses: CWE-203

Prevents attackers from using observable differences in error responses to infer internal system details or state.

References