CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

CVE-2024-50383

Botan before 3.6.0 is affected by CVE-2024-50383 due to a compiler-induced secret-dependent operation in donna128.h (donna128) used by ChaCha-Poly1305 and x25519. The issue was observed with GCC 11.3.0 -O2 on MIPS and GCC on x86-32 (only 32-bit processors). Reports in Mageia/openSUSE/Ubutnu advis...

PT-2024-7941 · Botan +3 · Botan +3

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 3.6.0 Description: The issue is related to a component of the Botan cryptographic library, specifically in lib/utils/ghash/ghash.cpp, where there is a potential information disclosure due to inconsistency. This could...

PT-2024-7940

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.6.0 Description The issue is related to a compiler-induced secret-dependent operation in the lib/utils/donna128.h component of the Botan cryptographic library. This can lead to information disclosure through...

The vulnerability of the C++ Botan cryptographic library, related to incorrect certificate verification, allows attackers to influence the integrity of the system.

The vulnerability of the C++ Botan cryptographic library is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the system remotely...

The vulnerability of the C++ Botan cryptographic library, related to asymmetric resource consumption, allows a hacker to induce a service failure.

The vulnerability of the C++ Botan cryptographic library is related to asymmetric resource consumption due to an excessive number of names in the subjectAlternativeName field during the processing of X.509 certificates. Exploiting this vulnerability can allow a remote attacker to cause service...

ROS-20241001-13

A vulnerability in the Botan C++ cryptographic library is related to asymmetric resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A vulnerability in the C++ Botan cryptographic library is related to errors in parsing...

MGASA-2024-0297 Updated botan2 packages fix security vulnerability

An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at mos...

The vulnerability of the Botan cryptographic library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Botan cryptographic library is related to uncontrolled resource consumption. Exploiting this vulnerability allows a remote attacker to trigger a service failure using a specially created ECDSA X.509 certificate...

OESA-2024-1925 botan2 security update

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

OESA-2024-1924 botan2 security update

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

OESA-2024-1923 botan2 security update

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

[SECURITY] Fedora 40 Update: botan2-2.19.5-1.fc40

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

openSUSE Security Advisory (openSUSE-SU-2024:0201-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15 Security Update : Botan (openSUSE-SU-2024:0201-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0201-1 advisory. Update to 2.19.5: Fix multiple Denial of service attacks due to X.509 cert processing: CVE-2024-34702 - boo1227238 CVE-2024-34703 - boo1227607...

OPENSUSE-SU-2024:0201-1 Security update for Botan

This update for Botan fixes the following issues: Update to 2.19.5: Fix multiple Denial of service attacks due to X.509 cert processing: CVE-2024-34702 - boo1227238 CVE-2024-34703 - boo1227607 CVE-2024-39312 - boo1227608 Fix a crash in OCB Fix a test failure in compression with certain versions o...

Security update for Botan (moderate)

openSUSE Security Update: Security update for Botan Announcement ID: openSUSE-SU-2024:0201-1 Rating: moderate References: 1227238 1227607 1227608 Cross-References: CVE-2024-34702 CVE-2024-34703 CVE-2024-39312 CVSS scores: CVE-2024-34702 SUSE: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L...

OPENSUSE-SU-2024:14188-1 Botan-doc-2.19.5-1.1 on GA media

These are all security issues fixed in the Botan-doc-2.19.5-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2024:2415-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2415-1 advisory. Security fixes: - CVE-2024-34703: Fixed denial of service due to overly large elliptic curve parameters i...

ROS-20240709-04

The vulnerability in the C++ Botan cryptographic library is related to resource allocation without constraints and regulation. Exploitation of the vulnerability could allow an attacker acting remotely to forge a an ECDSA X.509 certificate...