{"action":"Upgrade libgcrypt to 1.8.4-r2 or later.","affected":[{"fixed":"1.8.4-r2","introduced":"0"}],"component":"libgcrypt","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.13","exploited":false,"fixed_versions":["1.8.4-r2"],"id":"tcs_01M5NB857W3ZX2E53J31X7FWRF","modified_at":"2026-09-21T06:17:52.468441611Z","published_at":"2019-06-20T00:15:10.667Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2019-12904","https://security.alpinelinux.org/vuln/CVE-2019-12904"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2019-12904#Alpine:v3.13/libgcrypt","url":"https://osv.dev/vulnerability/ALPINE-CVE-2019-12904"}],"summary":"In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on pl"}