PT-2018-19081 · Botan · Botan

Publicado 2018-04-12 · Atualizado 2024-06-15 · CVE-2018-9860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.32 through 2.x before 2.6.0

Description An issue was discovered that could cause a denial of service due to an off-by-one error when processing malformed TLS-CBC ciphertext. This error leads to an over-read, including exactly 64K bytes of data following the record buffer in the HMAC computation, which will subsequently fail the MAC comparison and close the connection. No information leak occurs.

Recommendations For versions 1.11.32 through 2.x before 2.6.0, update to version 2.6.0 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

CVE-2018-9860

OPENSUSE-SU-2024:10594-1

Produtos afetados

Botan

Referências · 20

• https://github.com/randombit/botan/commit/ec222c99719c396a1f4756b2ca345dbbfbeb5ed5 · Nota
• https://security.alpinelinux.org/vuln/CVE-2018-9860 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9860 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-14737 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9860 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-9860 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-9860 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-9860 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-12435 · Nota
• https://osv.dev/vulnerability/CVE-2018-9860 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9132 · Nota
• https://suse.com/security/cve/CVE-2018-9127 · Nota
• https://suse.com/security/cve/CVE-2018-20187 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2018-9860 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-2801 · Nota