PT-2016-7602 · Botan · Botan

Juraj Somorovsky · Published 2016-10-28 · Updated 2016-11-29 · CVE-2016-8871

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.29 through 1.11.32

Description The issue concerns a detectable timing channel in RSA decryption with certain padding options. This could potentially allow an attacker to recover plaintext through an "OAEP side channel" attack, given sufficient queries.

Recommendations For versions 1.11.29 through 1.11.32, consider updating to a version that fixes the timing channel issue in RSA decryption to prevent potential plaintext recovery attacks.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-8871

Affected Products

Botan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8871 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8871 · Vendor Advisory
• https://botan.randombit.net/security.html · Vendor Advisory
• http://securityfocus.com/bid/94225 · Note