PT-2017-13660 · Botan+2 · Botan+2

Published 2017-09-26 · Updated 2024-06-15 · CVE-2017-14737

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 1.10.17 Botan versions 1.11.x Botan versions 2.x prior to 2.3.0

Description A cryptographic cache-based side channel in the RSA implementation allows a local attacker to recover information about RSA secret keys. This occurs because an array is indexed with bits derived from a secret key. The issue is demonstrated by CacheD.

Recommendations For Botan versions prior to 1.10.17, update to version 1.10.17 or later. For Botan versions 1.11.x, update to version 2.3.0 or later. For Botan versions 2.x prior to 2.3.0, update to version 2.3.0 or later.

Fix

Related Identifiers

ALT-PU-2018-1589

CVE-2017-14737

DLA-1125-1

DLA-2812-1

MGASA-2017-0422

OPENSUSE-SU-2024:10594-1

SUSE-SU-2017:2855-1

SUSE-SU-2017_2855-1

Affected Products

Alt Linux

Botan

Suse

References · 41

• https://osv.dev/vulnerability/openSUSE-SU-2024:10594-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14737 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0422 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RPHA5S6ZQM46XJ2CGDEETO6U6I6M5NEG · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14737 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1589 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14737 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2812-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7827 · Security Note
• https://security-tracker.debian.org/tracker/source-package/botan1.10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14737 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2194 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-14737 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2195 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5727 · Security Note