ID FEDORA:8A38060C5F57 Type fedora Reporter Fedora Modified 2015-07-16T02:37:42
Description
Crypto++ Library is a free C++ class library of cryptographic schemes. See http://www.cryptopp.com/ for a list of supported algorithms. One purpose of Crypto++ is to act as a repository of public domain (not copyrighted) source code. Although the library is copyrighted as a compilation, the individual files in it are in the public domain.
{"id": "FEDORA:8A38060C5F57", "type": "fedora", "bulletinFamily": "unix", "title": "[SECURITY] Fedora 22 Update: cryptopp-5.6.2-9.fc22", "description": "Crypto++ Library is a free C++ class library of cryptographic schemes. See http://www.cryptopp.com/ for a list of supported algorithms. One purpose of Crypto++ is to act as a repository of public domain (not copyrighted) source code. Although the library is copyrighted as a compilation, the individual files in it are in the public domain. ", "published": "2015-07-16T02:37:42", "modified": "2015-07-16T02:37:42", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "", "reporter": "Fedora", "references": [], "cvelist": ["CVE-2015-2141"], "lastseen": "2020-12-21T08:17:53", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2015-2141"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310130062", "OPENVAS:1361412562310869756", "OPENVAS:1361412562310703296", "OPENVAS:1361412562310869760", "OPENVAS:703296"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-3296.NASL", "FEDORA_2015-10911.NASL", "DEBIAN_DLA-262.NASL", "FREEBSD_PKG_EAB68CFFBC0C11E6B2CA001B3856973B.NASL", "OPENSUSE-2015-504.NASL", "FEDORA_2015-10914.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32274", "SECURITYVULNS:VULN:14565"]}, {"type": "debian", "idList": ["DEBIAN:DLA-262-1:F168E", "DEBIAN:DSA-3296-1:2B0E7"]}, {"type": "archlinux", "idList": ["ASA-201507-20"]}, {"type": "fedora", "idList": ["FEDORA:E7DA560C679A"]}, {"type": "freebsd", "idList": ["EAB68CFF-BC0C-11E6-B2CA-001B3856973B"]}], "modified": "2020-12-21T08:17:53", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2020-12-21T08:17:53", "rev": 2}, "vulnersScore": 5.7}, "affectedPackage": [{"OS": "Fedora", "OSVersion": "22", "arch": "any", "packageName": "cryptopp", "packageVersion": "5.6.2", "packageFilename": "UNKNOWN", "operator": "lt"}]}
{"cve": [{"lastseen": "2021-02-02T06:21:22", "description": "The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.", "edition": 4, "cvss3": {}, "published": "2015-07-01T14:59:00", "title": "CVE-2015-2141", "type": "cve", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-2141"], "modified": "2018-10-30T16:27:00", "cpe": ["cpe:/a:cryptopp:crypto\\+\\+_library:5.6.2", "cpe:/o:opensuse:opensuse:13.1", "cpe:/o:opensuse:opensuse:13.2"], "id": "CVE-2015-2141", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2141", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe:2.3:a:cryptopp:crypto\\+\\+_library:5.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"]}], "securityvulns": [{"lastseen": "2018-08-31T11:10:01", "bulletinFamily": "software", "cvelist": ["CVE-2015-2141"], "description": "Rabin-Williams algorithm timing attacks.", "edition": 1, "modified": "2015-07-05T00:00:00", "published": "2015-07-05T00:00:00", "id": "SECURITYVULNS:VULN:14565", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14565", "title": "libcrypto++ timing attacks", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-08-31T11:11:00", "bulletinFamily": "software", "cvelist": ["CVE-2015-2141"], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-3296-1 security@debian.org\r\nhttps://www.debian.org/security/ Alessandro Ghedini\r\nJune 29, 2015 https://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : libcrypto++\r\nCVE ID : CVE-2015-2141\r\n\r\nEvgeny Sidorov discovered that libcrypto++, a general purpose C++\r\ncryptographic library, did not properly implement blinding to mask\r\nprivate key operations for the Rabin-Williams digital signature\r\nalgorithm. This could allow remote attackers to mount a timing attack\r\nand retrieve the user's private key.\r\n\r\nFor the oldstable distribution (wheezy), this problem has been fixed\r\nin version 5.6.1-6+deb7u1.\r\n\r\nFor the stable distribution (jessie), this problem has been fixed in\r\nversion 5.6.1-6+deb8u1.\r\n\r\nFor the testing distribution (stretch), this problem will be fixed\r\nin version 5.6.1-7.\r\n\r\nFor the unstable distribution (sid), this problem has been fixed in\r\nversion 5.6.1-7.\r\n\r\nWe recommend that you upgrade your libcrypto++ packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: https://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBCgAGBQJVkQXjAAoJEK+lG9bN5XPLGCoP/jlLKGCEKcVIyNFSzNQ3r/K2\r\nj9pYi/aRG8XtKXawti8cG33nhXbjlqKf96kGPHx7Deu9CBiDm5prscfGqUGfc6ru\r\nvQhdkamghhI8OsLKeitqHXPFNDleFXa3UlwomBNIqUXzQyREDidQJKZhhg1RS5dY\r\nsovbJtUwm0H7F98+u1tEE3tyQQC8VcX3xXncXgVMV4HcVcOj+4tEl64PljUSeGzW\r\nHz2FqQLqk4t7ckT31vlKtVQivAvPiDVu0EazTAnnQkm0FEQCScVCdQz744Ox5RzO\r\nP/nuYuK2n5QuI9/0LbnCniEY1wqIKvkXh00lrG00QKbtWpdw891nc7FoMeO6qfLe\r\njVYiJjfV5/tJwFYGr5Dd9ShPXQUR7UnIPh3rgAIYWhYkYE0KHhUBZXcVElSOwCOR\r\nZXuZ9F6I9cXX8NLRBULfXXasPNLi+gYMYcGbF9y1dDaYXH+sskuRXWh1tat2PvuO\r\n6e4u49UyiVvd5GnUWv5IIJJcrCoCayewRsHBsddeagtgtXCA+LRLg9uylm1HELNL\r\nrjG+yZcoMRmojyCiEHN5xJekjkK0P82moURBTKq1cnL6eb3GhGB95VJ4UKqg/RNS\r\niGnxrfijoK5ZN7m8qylvoVQExQ8q1nOKSJT1lcpvFAVyFh4RVcjuMALsVIOgVURC\r\nXg0YheXBZs4lRtCcKLtl\r\n=NhFp\r\n-----END PGP SIGNATURE-----\r\n\r\n", "edition": 1, "modified": "2015-07-05T00:00:00", "published": "2015-07-05T00:00:00", "id": "SECURITYVULNS:DOC:32274", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32274", "title": "[SECURITY] [DSA 3296-1] libcrypto++ security update", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2015-2141"], "description": "Crypto++ Library is a free C++ class library of cryptographic schemes. See http://www.cryptopp.com/ for a list of supported algorithms. One purpose of Crypto++ is to act as a repository of public domain (not copyrighted) source code. Although the library is copyrighted as a compilation, the individual files in it are in the public domain. ", "modified": "2015-07-16T02:37:03", "published": "2015-07-16T02:37:03", "id": "FEDORA:E7DA560C679A", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: cryptopp-5.6.2-9.fc21", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "nessus": [{"lastseen": "2021-01-12T09:43:35", "description": "Evgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.", "edition": 15, "published": "2015-07-01T00:00:00", "title": "Debian DLA-262-1 : libcrypto++ security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "modified": "2015-07-01T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:6.0", "p-cpe:/a:debian:debian_linux:libcrypto++-dev", "p-cpe:/a:debian:debian_linux:libcrypto++8-dbg", "p-cpe:/a:debian:debian_linux:libcrypto++-doc", "p-cpe:/a:debian:debian_linux:libcrypto++-utils", "p-cpe:/a:debian:debian_linux:libcrypto++8"], "id": "DEBIAN_DLA-262.NASL", "href": "https://www.tenable.com/plugins/nessus/84473", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-262-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(84473);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-2141\");\n script_bugtraq_id(75467);\n\n script_name(english:\"Debian DLA-262-1 : libcrypto++ security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2015/06/msg00029.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/libcrypto++\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++8-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/06/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libcrypto++-dev\", reference:\"5.6.0-6+deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcrypto++-doc\", reference:\"5.6.0-6+deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcrypto++-utils\", reference:\"5.6.0-6+deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcrypto++8\", reference:\"5.6.0-6+deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcrypto++8-dbg\", reference:\"5.6.0-6+deb6u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-12T10:13:14", "description": " - Fix for CVE-2015-2141\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 17, "published": "2015-07-16T00:00:00", "title": "Fedora 22 : cryptopp-5.6.2-9.fc22 (2015-10914)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "modified": "2015-07-16T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:cryptopp", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2015-10914.NASL", "href": "https://www.tenable.com/plugins/nessus/84774", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-10914.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(84774);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-2141\");\n script_xref(name:\"FEDORA\", value:\"2015-10914\");\n\n script_name(english:\"Fedora 22 : cryptopp-5.6.2-9.fc22 (2015-10914)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fix for CVE-2015-2141\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162027.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c28a23bb\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected cryptopp package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:cryptopp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/06/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"cryptopp-5.6.2-9.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"cryptopp\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-12T10:13:14", "description": " - Fix for CVE-2015-2141\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 17, "published": "2015-07-16T00:00:00", "title": "Fedora 21 : cryptopp-5.6.2-9.fc21 (2015-10911)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "modified": "2015-07-16T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:21", "p-cpe:/a:fedoraproject:fedora:cryptopp"], "id": "FEDORA_2015-10911.NASL", "href": "https://www.tenable.com/plugins/nessus/84773", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-10911.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(84773);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-2141\");\n script_xref(name:\"FEDORA\", value:\"2015-10911\");\n\n script_name(english:\"Fedora 21 : cryptopp-5.6.2-9.fc21 (2015-10911)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fix for CVE-2015-2141\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162023.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?99b25f38\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected cryptopp package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:cryptopp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/06/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"cryptopp-5.6.2-9.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"cryptopp\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-12T09:49:09", "description": "Evgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.", "edition": 23, "published": "2015-06-29T00:00:00", "title": "Debian DSA-3296-1 : libcrypto++ - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "modified": "2015-06-29T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/o:debian:debian_linux:7.0", "p-cpe:/a:debian:debian_linux:libcrypto++"], "id": "DEBIAN_DSA-3296.NASL", "href": "https://www.tenable.com/plugins/nessus/84436", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3296. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(84436);\n script_version(\"2.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-2141\");\n script_xref(name:\"DSA\", value:\"3296\");\n\n script_name(english:\"Debian DSA-3296-1 : libcrypto++ - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/libcrypto++\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/libcrypto++\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2015/dsa-3296\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the libcrypto++ packages.\n\nFor the oldstable distribution (wheezy), this problem has been fixed\nin version 5.6.1-6+deb7u1.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 5.6.1-6+deb8u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcrypto++\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/06/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/06/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libcrypto++-dev\", reference:\"5.6.1-6+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libcrypto++-doc\", reference:\"5.6.1-6+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libcrypto++-utils\", reference:\"5.6.1-6+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libcrypto++9\", reference:\"5.6.1-6+deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libcrypto++9-dbg\", reference:\"5.6.1-6+deb7u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcrypto++-dev\", reference:\"5.6.1-6+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcrypto++-doc\", reference:\"5.6.1-6+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcrypto++-utils\", reference:\"5.6.1-6+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcrypto++9\", reference:\"5.6.1-6+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcrypto++9-dbg\", reference:\"5.6.1-6+deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-20T12:28:39", "description": "libcryptopp was updated to fix one security issue.\n\nThis security issue was fixed :\n\n - CVE-2015-2141: The\n InvertibleRWFunction::CalculateInverse function in\n rw.cpp in libcrypt++ 5.6.2 did not properly blind\n private key operations for the Rabin-Williams digital\n signature algorithm, which allowed remote attackers to\n obtain private keys via a timing attack (bsc#936435).", "edition": 17, "published": "2015-07-21T00:00:00", "title": "openSUSE Security Update : libcryptopp (openSUSE-2015-504)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "modified": "2015-07-21T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libcryptopp-devel", "p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-debuginfo", "p-cpe:/a:novell:opensuse:libcryptopp-debugsource", "p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-32bit", "p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0", "p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-debuginfo-32bit", "cpe:/o:novell:opensuse:13.2", "p-cpe:/a:novell:opensuse:libcryptopp-devel-static", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2015-504.NASL", "href": "https://www.tenable.com/plugins/nessus/84888", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-504.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(84888);\n script_version(\"2.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2015-2141\");\n\n script_name(english:\"openSUSE Security Update : libcryptopp (openSUSE-2015-504)\");\n script_summary(english:\"Check for the openSUSE-2015-504 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"libcryptopp was updated to fix one security issue.\n\nThis security issue was fixed :\n\n - CVE-2015-2141: The\n InvertibleRWFunction::CalculateInverse function in\n rw.cpp in libcrypt++ 5.6.2 did not properly blind\n private key operations for the Rabin-Williams digital\n signature algorithm, which allowed remote attackers to\n obtain private keys via a timing attack (bsc#936435).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=936435\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libcryptopp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-5_6_2-0-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcryptopp-devel-static\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1|SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1 / 13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcryptopp-5_6_2-0-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcryptopp-5_6_2-0-debuginfo-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcryptopp-debugsource-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcryptopp-devel-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcryptopp-devel-static-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libcryptopp-5_6_2-0-32bit-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libcryptopp-5_6_2-0-debuginfo-32bit-5.6.2-2.4.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcryptopp-5_6_2-0-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcryptopp-5_6_2-0-debuginfo-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcryptopp-debugsource-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcryptopp-devel-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcryptopp-devel-static-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libcryptopp-5_6_2-0-32bit-5.6.2-7.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libcryptopp-5_6_2-0-debuginfo-32bit-5.6.2-7.4.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libcryptopp-5_6_2-0-32bit / libcryptopp-5_6_2-0 / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-06T10:59:32", "description": "Multiple sources report :\n\nCVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in\nrw.cpp in libcrypt++ 5.6.2 does not properly blind private key\noperations for the Rabin-Williams digital signature algorithm, which\nallows remote attackers to obtain private keys via a timing attack.\nFixed in 5.6.3.\n\nCVE-2016-3995: Incorrect implementation of Rijndael timing attack\ncountermeasure. Fixed in 5.6.4.\n\nCVE-2016-7420: Library built without -DNDEBUG could egress sensitive\ninformation to the filesystem via a core dump if an assert was\ntriggered. Fixed in 5.6.5.", "edition": 25, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-12-07T00:00:00", "title": "FreeBSD : cryptopp -- multiple vulnerabilities (eab68cff-bc0c-11e6-b2ca-001b3856973b)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-3995", "CVE-2016-7420", "CVE-2015-2141"], "modified": "2016-12-07T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:cryptopp"], "id": "FREEBSD_PKG_EAB68CFFBC0C11E6B2CA001B3856973B.NASL", "href": "https://www.tenable.com/plugins/nessus/95589", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(95589);\n script_version(\"3.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2015-2141\", \"CVE-2016-3995\", \"CVE-2016-7420\");\n\n script_name(english:\"FreeBSD : cryptopp -- multiple vulnerabilities (eab68cff-bc0c-11e6-b2ca-001b3856973b)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple sources report :\n\nCVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in\nrw.cpp in libcrypt++ 5.6.2 does not properly blind private key\noperations for the Rabin-Williams digital signature algorithm, which\nallows remote attackers to obtain private keys via a timing attack.\nFixed in 5.6.3.\n\nCVE-2016-3995: Incorrect implementation of Rijndael timing attack\ncountermeasure. Fixed in 5.6.4.\n\nCVE-2016-7420: Library built without -DNDEBUG could egress sensitive\ninformation to the filesystem via a core dump if an assert was\ntriggered. Fixed in 5.6.5.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://eprint.iacr.org/2015/368\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/weidai11/cryptopp/issues/146\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://github.com/weidai11/cryptopp/issues/277\"\n );\n # https://vuxml.freebsd.org/freebsd/eab68cff-bc0c-11e6-b2ca-001b3856973b.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?97dc820e\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:cryptopp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/12/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/12/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"cryptopp<5.6.5\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "openvas": [{"lastseen": "2019-05-29T18:36:21", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-07-16T00:00:00", "id": "OPENVAS:1361412562310869760", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869760", "type": "openvas", "title": "Fedora Update for cryptopp FEDORA-2015-10914", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for cryptopp FEDORA-2015-10914\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869760\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-16 06:15:20 +0200 (Thu, 16 Jul 2015)\");\n script_cve_id(\"CVE-2015-2141\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for cryptopp FEDORA-2015-10914\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'cryptopp'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"cryptopp on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-10914\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162027.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"cryptopp\", rpm:\"cryptopp~5.6.2~9.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2017-07-24T12:52:49", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "description": "Evgeny Sidorov discovered that\nlibcrypto++, a general purpose C++ cryptographic library, did not properly\nimplement blinding to mask private key operations for the Rabin-Williams\ndigital signature algorithm. This could allow remote attackers to mount a\ntiming attack and retrieve the user", "modified": "2017-07-07T00:00:00", "published": "2015-06-29T00:00:00", "id": "OPENVAS:703296", "href": "http://plugins.openvas.org/nasl.php?oid=703296", "type": "openvas", "title": "Debian Security Advisory DSA 3296-1 (libcrypto++ - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3296.nasl 6609 2017-07-07 12:05:59Z cfischer $\n# Auto-generated from advisory DSA 3296-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703296);\n script_version(\"$Revision: 6609 $\");\n script_cve_id(\"CVE-2015-2141\");\n script_name(\"Debian Security Advisory DSA 3296-1 (libcrypto++ - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:59 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2015-06-29 00:00:00 +0200 (Mon, 29 Jun 2015)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3296.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"libcrypto++ on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the oldstable distribution (wheezy),\nthis problem has been fixed in version 5.6.1-6+deb7u1.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 5.6.1-6+deb8u1.\n\nFor the testing distribution (stretch), this problem will be fixed\nin version 5.6.1-7.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.6.1-7.\n\nWe recommend that you upgrade your libcrypto++ packages.\");\n script_tag(name: \"summary\", value: \"Evgeny Sidorov discovered that\nlibcrypto++, a general purpose C++ cryptographic library, did not properly\nimplement blinding to mask private key operations for the Rabin-Williams\ndigital signature algorithm. This could allow remote attackers to mount a\ntiming attack and retrieve the user's private key.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libcrypto++-dev\", ver:\"5.6.1-6+deb7u1\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcrypto++-doc\", ver:\"5.6.1-6+deb7u1\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcrypto++-utils\", ver:\"5.6.1-6+deb7u1\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcrypto++9\", ver:\"5.6.1-6+deb7u1\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcrypto++9-dbg\", ver:\"5.6.1-6+deb7u1\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2019-05-29T18:36:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "description": "Mageia Linux Local Security Checks mgasa-2015-0317", "modified": "2018-09-28T00:00:00", "published": "2015-10-15T00:00:00", "id": "OPENVAS:1361412562310130062", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310130062", "type": "openvas", "title": "Mageia Linux Local Check: mgasa-2015-0317", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mgasa-2015-0317.nasl 11692 2018-09-28 16:55:19Z cfischer $\n#\n# Mageia Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://www.solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.130062\");\n script_version(\"$Revision: 11692 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-15 10:42:15 +0300 (Thu, 15 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 18:55:19 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Mageia Linux Local Check: mgasa-2015-0317\");\n script_tag(name:\"insight\", value:\"Evgeny Sidorov discovered that libcryptopp did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's private key (CVE-2015-2141).\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://advisories.mageia.org/MGASA-2015-0317.html\");\n script_cve_id(\"CVE-2015-2141\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mageia_linux\", \"ssh/login/release\", re:\"ssh/login/release=MAGEIA5\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Mageia Linux Local Security Checks mgasa-2015-0317\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Mageia Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MAGEIA5\")\n{\nif ((res = isrpmvuln(pkg:\"libcryptopp\", rpm:\"libcryptopp~5.6.2~4.1.mga5\", rls:\"MAGEIA5\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:36:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "description": "Evgeny Sidorov discovered that\nlibcrypto++, a general purpose C++ cryptographic library, did not properly\nimplement blinding to mask private key operations for the Rabin-Williams\ndigital signature algorithm. This could allow remote attackers to mount a\ntiming attack and retrieve the user", "modified": "2019-03-18T00:00:00", "published": "2015-06-29T00:00:00", "id": "OPENVAS:1361412562310703296", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703296", "type": "openvas", "title": "Debian Security Advisory DSA 3296-1 (libcrypto++ - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3296.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Auto-generated from advisory DSA 3296-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703296\");\n script_version(\"$Revision: 14275 $\");\n script_cve_id(\"CVE-2015-2141\");\n script_name(\"Debian Security Advisory DSA 3296-1 (libcrypto++ - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-06-29 00:00:00 +0200 (Mon, 29 Jun 2015)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2015/dsa-3296.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"libcrypto++ on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (wheezy),\nthis problem has been fixed in version 5.6.1-6+deb7u1.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 5.6.1-6+deb8u1.\n\nFor the testing distribution (stretch), this problem will be fixed\nin version 5.6.1-7.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.6.1-7.\n\nWe recommend that you upgrade your libcrypto++ packages.\");\n script_tag(name:\"summary\", value:\"Evgeny Sidorov discovered that\nlibcrypto++, a general purpose C++ cryptographic library, did not properly\nimplement blinding to mask private key operations for the Rabin-Williams\ndigital signature algorithm. This could allow remote attackers to mount a\ntiming attack and retrieve the user's private key.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libcrypto++-dev\", ver:\"5.6.1-6+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcrypto++-doc\", ver:\"5.6.1-6+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcrypto++-utils\", ver:\"5.6.1-6+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcrypto++9\", ver:\"5.6.1-6+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcrypto++9-dbg\", ver:\"5.6.1-6+deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:36:19", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-2141"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-07-16T00:00:00", "id": "OPENVAS:1361412562310869756", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869756", "type": "openvas", "title": "Fedora Update for cryptopp FEDORA-2015-10911", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for cryptopp FEDORA-2015-10911\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869756\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-16 06:15:15 +0200 (Thu, 16 Jul 2015)\");\n script_cve_id(\"CVE-2015-2141\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for cryptopp FEDORA-2015-10911\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'cryptopp'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"cryptopp on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-10911\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162023.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"cryptopp\", rpm:\"cryptopp~5.6.2~9.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:48", "bulletinFamily": "unix", "cvelist": ["CVE-2015-2141"], "description": "Evgeny Sidorov discovered that it is possible to recover the private key\nwhen using Rabin-Williams signatures due to a bad interaction with the\nblinding value used to mask private key operations. The bad interaction\nhad to do with the random value not meeting certain Jacobi requirements,\nwhich allows remote attackers to obtain private keys via a timing attack.", "modified": "2015-07-24T00:00:00", "published": "2015-07-24T00:00:00", "id": "ASA-201507-20", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-July/000374.html", "type": "archlinux", "title": "crypto++: private key recovery", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "debian": [{"lastseen": "2020-11-11T13:14:07", "bulletinFamily": "unix", "cvelist": ["CVE-2015-2141"], "description": "Package : libcrypto++\nVersion : 5.6.0-6+deb6u1\nCVE ID : CVE-2015-2141\n\nEvgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.\n", "edition": 9, "modified": "2015-06-30T21:00:27", "published": "2015-06-30T21:00:27", "id": "DEBIAN:DLA-262-1:F168E", "href": "https://lists.debian.org/debian-lts-announce/2015/debian-lts-announce-201506/msg00029.html", "title": "[SECURITY] [DLA 262-1] libcrypto++ security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-08-12T01:01:27", "bulletinFamily": "unix", "cvelist": ["CVE-2015-2141"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3296-1 security@debian.org\nhttps://www.debian.org/security/ Alessandro Ghedini\nJune 29, 2015 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : libcrypto++\nCVE ID : CVE-2015-2141\n\nEvgeny Sidorov discovered that libcrypto++, a general purpose C++\ncryptographic library, did not properly implement blinding to mask\nprivate key operations for the Rabin-Williams digital signature\nalgorithm. This could allow remote attackers to mount a timing attack\nand retrieve the user's private key.\n\nFor the oldstable distribution (wheezy), this problem has been fixed\nin version 5.6.1-6+deb7u1.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 5.6.1-6+deb8u1.\n\nFor the testing distribution (stretch), this problem will be fixed\nin version 5.6.1-7.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.6.1-7.\n\nWe recommend that you upgrade your libcrypto++ packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 9, "modified": "2015-06-29T08:46:45", "published": "2015-06-29T08:46:45", "id": "DEBIAN:DSA-3296-1:2B0E7", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2015/msg00192.html", "title": "[SECURITY] [DSA 3296-1] libcrypto++ security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "freebsd": [{"lastseen": "2019-05-29T18:32:25", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3995", "CVE-2016-7420", "CVE-2015-2141"], "description": "\nMultiple sources report:\n\nCVE-2015-2141: The InvertibleRWFunction::CalculateInverse function\n\t in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key\n\t operations for the Rabin-Williams digital signature algorithm, which\n\t allows remote attackers to obtain private keys via a timing attack.\n\t Fixed in 5.6.3.\n\n\nCVE-2016-3995: Incorrect implementation of Rijndael timing attack\n\t countermeasure. Fixed in 5.6.4.\n\n\nCVE-2016-7420: Library built without -DNDEBUG could egress sensitive\n\t information to the filesystem via a core dump if an assert was triggered.\n\t Fixed in 5.6.5.\n\n", "edition": 4, "modified": "2015-02-27T00:00:00", "published": "2015-02-27T00:00:00", "id": "EAB68CFF-BC0C-11E6-B2CA-001B3856973B", "href": "https://vuxml.freebsd.org/freebsd/eab68cff-bc0c-11e6-b2ca-001b3856973b.html", "title": "cryptopp -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}
