PT-2016-7602 · Botan · Botan

Juraj Somorovsky · Publicado 2016-10-28 · Atualizado 2016-11-29 · CVE-2016-8871

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.29 through 1.11.32

Description The issue concerns a detectable timing channel in RSA decryption with certain padding options. This could potentially allow an attacker to recover plaintext through an "OAEP side channel" attack, given sufficient queries.

Recommendations For versions 1.11.29 through 1.11.32, consider updating to a version that fixes the timing channel issue in RSA decryption to prevent potential plaintext recovery attacks.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-8871

Produtos afetados

Botan

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8871 · Nota de Segurança
• http://securityfocus.com/bid/94225 · Nota
• https://osv.dev/vulnerability/CVE-2016-8871 · Aviso do Fabricante
• https://botan.randombit.net/security.html · Aviso do Fabricante