botan project botan 1.11.22 vulnerabilities and exploits

(subscribe to this query)

10

CVSSv2

Integer overflow in the PointGFp constructor in Botan prior to 1.10.11 and 1.11.x prior to 1.11.27 allows remote malicious users to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.

5

CVSSv2

Botan prior to 1.10.13 and 1.11.x prior to 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote malicious users to obtain ECDSA secret keys via a timing side-channel attack.

2.1

CVSSv2

A cryptographic cache-based side channel in the RSA implementation in Botan prior to 1.10.17, and 1.11.x and 2.x prior to 2.3.0, allows a local malicious user to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bit...

5

CVSSv2

botan 1.11.x prior to 1.11.22 makes it easier for remote malicious users to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites.

Botan Project Botan

7.8

CVSSv2

botan prior to 1.11.22 improperly validates certificate paths, which allows remote malicious users to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain.

Botan Project Botan

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook