Описание
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/bionic | ignored | changes too intrusive |
| esm-apps/focal | needed | |
| esm-apps/jammy | released | 2.19.1+dfsg-2ubuntu1+esm1 |
| esm-apps/noble | released | 2.19.3+dfsg-1ubuntu2+esm1 |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needed | |
| noble | needed | |
| oracular | released | 2.19.3+dfsg-1ubuntu2.1 |
| plucky | not-affected | 2.19.5+dfsg-4 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| focal | ignored | end of standard support, was needs-triage |
| jammy | needs-triage | |
| noble | needs-triage | |
| oracular | ignored | end of life, was needs-triage |
| plucky | ignored | end of life, was needs-triage |
| questing | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | |
| esm-infra/focal | DNE | |
| focal | not-affected | |
| jammy | not-affected | |
| noble | not-affected | |
| oracular | not-affected | |
| plucky | not-affected | |
| questing | not-affected | |
| upstream | needs-triage |
Показывать по
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)
Botan before 3.6.0, when certain GCC versions are used, has a compiler ...
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)
Уязвимость компонента lib/utils/donna128.h криптографической библиотеки Botan, связанная с раскрытием информации через несоответствие, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
5.9 Medium
CVSS3