PT-2016-5238 · Botan+1 · Botan+1

Sean Devlin · Publicado 2016-05-02 · Atualizado 2024-06-15 · CVE-2016-2849

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 1.10.13 Botan versions 1.11.x prior to 1.11.29

Description The issue is related to the modular inverse operation on the signature nonce k in the ECDSA algorithm. It does not use a constant-time algorithm, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

Recommendations For versions prior to 1.10.13, update to version 1.10.13 or later. For versions 1.11.x prior to 1.11.29, update to version 1.11.29 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-2849

DLA-449-1

DSA-3565-1

DSA-3565-2

MGASA-2016-0208

OPENSUSE-SU-2024:10477-1

SUSE-SU-2017:1222-1

Produtos afetados

Botan

Suse

Referências · 48

• https://cve.org/CVERecord?id=CVE-2016-2849 · Nota de Segurança
• https://bugzilla.suse.com/965620 · Nota
• http://marc.info/?l=botan-devel&m=146185420505943&w=2 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3565-2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-7827 · Nota
• https://security-tracker.debian.org/tracker/DSA-3565-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2195 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2195 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2016-0208 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2017/suse-su-20171222-1 · Nota
• https://suse.com/security/cve/CVE-2016-2849 · Nota
• https://bugzilla.suse.com/1013209 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10477-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9132 · Nota
• https://bugzilla.suse.com/968026 · Nota