Описание
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.19.5+dfsg-4 |
| esm-apps/bionic | ignored | changes too intrusive |
| esm-apps/focal | needed | |
| esm-apps/jammy | released | 2.19.1+dfsg-2ubuntu1+esm1 |
| esm-apps/noble | released | 2.19.3+dfsg-1ubuntu2+esm1 |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needed | |
| noble | needed | |
| oracular | released | 2.19.3+dfsg-1ubuntu2.1 |
| plucky | not-affected | 2.19.5+dfsg-4 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needs-triage | |
| noble | needs-triage | |
| oracular | ignored | end of life, was needs-triage |
| plucky | needs-triage | |
| questing | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | |
| esm-infra/focal | DNE | |
| focal | not-affected | |
| jammy | not-affected | |
| noble | not-affected | |
| oracular | not-affected | |
| plucky | not-affected | |
| questing | not-affected | |
| upstream | needs-triage |
Показывать по
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
Botan before 3.6.0, when certain LLVM versions are used, has compiler- ...
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
Уязвимость компонента lib/utils/ghash/ghash.cpp криптографической библиотеки Botan, связанная с раскрытием информации через несоответствие, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
5.9 Medium
CVSS3