PT-2018-19081 · Botan · Botan

Published 2018-04-12 · Updated 2024-06-15 · CVE-2018-9860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Botan versions 1.11.32 through 2.x before 2.6.0

Description An issue was discovered that could cause a denial of service due to an off-by-one error when processing malformed TLS-CBC ciphertext. This error leads to an over-read, including exactly 64K bytes of data following the record buffer in the HMAC computation, which will subsequently fail the MAC comparison and close the connection. No information leak occurs.

Recommendations For versions 1.11.32 through 2.x before 2.6.0, update to version 2.6.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2018-9860

OPENSUSE-SU-2024:10594-1

Affected Products

Botan

References · 20

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9860 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9860 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-9860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-9860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9860 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-9860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9860 · Security Note
• https://botan.randombit.net/security.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10594-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-9860 · Security Note
• https://github.com/randombit/botan/commit/ec222c99719c396a1f4756b2ca345dbbfbeb5ed5 · Note
• https://security.alpinelinux.org/vuln/CVE-2018-9860 · Note
• https://suse.com/security/cve/CVE-2017-14737 · Note
• https://suse.com/security/cve/CVE-2018-9860 · Note
• https://suse.com/security/cve/CVE-2018-12435 · Note