Search CVE reports
1 – 10 of 31 results
Some fixes available 3 of 10
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set....
3 affected packages
botan, oscar, thunderbird
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Fixed | Fixed | Vulnerable | Ignored |
| oscar | Needs evaluation | Needs evaluation | Needs evaluation | — |
| thunderbird | Not affected | Not affected | Not in release | — |
Some fixes available 3 of 10
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for...
3 affected packages
botan, oscar, thunderbird
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Fixed | Fixed | Vulnerable | Ignored |
| oscar | Needs evaluation | Needs evaluation | Needs evaluation | — |
| thunderbird | Not affected | Not affected | Not in release | — |
Some fixes available 3 of 6
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509...
1 affected package
botan
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Fixed | Fixed | Vulnerable | Ignored |
Some fixes available 3 of 5
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an...
1 affected package
botan
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Fixed | Fixed | Vulnerable | Not affected |
Some fixes available 3 of 6
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509...
1 affected package
botan
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Fixed | Fixed | Ignored | Ignored |
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
1 affected package
botan
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Not affected | Vulnerable | Vulnerable | Vulnerable |
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime...
2 affected packages
botan, botan1.10
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Not affected | Needs evaluation | Needs evaluation | Needs evaluation |
| botan1.10 | Not in release | Not in release | Not in release | Needs evaluation |
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
2 affected packages
botan, botan1.10
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Not affected | Not affected | Needs evaluation | Needs evaluation |
| botan1.10 | Not in release | Not in release | Not in release | Needs evaluation |
An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data...
2 affected packages
botan, botan1.10
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Not affected | Not affected | Not affected | Vulnerable |
| botan1.10 | Not in release | Not in release | Not in release | Not affected |
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to...
1 affected package
botan
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| botan | Not affected | Needs evaluation | Needs evaluation | Not affected |