PT-2016-5238 · Botan+1 · Botan+1

Sean Devlin · Published 2016-05-02 · Updated 2024-06-15 · CVE-2016-2849

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 1.10.13 Botan versions 1.11.x prior to 1.11.29

Description The issue is related to the modular inverse operation on the signature nonce k in the ECDSA algorithm. It does not use a constant-time algorithm, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

Recommendations For versions prior to 1.10.13, update to version 1.10.13 or later. For versions 1.11.x prior to 1.11.29, update to version 1.11.29 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-2849

DLA-449-1

DSA-3565-1

DSA-3565-2

MGASA-2016-0208

OPENSUSE-SU-2024:10477-1

SUSE-SU-2017:1222-1

Affected Products

Botan

Suse

References · 48

• https://cve.org/CVERecord?id=CVE-2016-2849 · Security Note
• http://marc.info/?l=botan-devel&m=146185420505943&w=2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3565-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3565-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2195 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0208 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10477-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0208.html · Security Note
• https://ubuntu.com/security/CVE-2016-2849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2849 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1222-1 · Vendor Advisory
• http://botan.randombit.net/security.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5726 · Security Note
• https://osv.dev/vulnerability/DSA-3565-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/botan1.10 · Vendor Advisory