MGASA-2016-0208

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2016-0208.html
Import Source
https://advisories.mageia.org/MGASA-2016-0208.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2016-0208
Related
Published
2016-05-29T13:55:26Z
Modified
2016-05-29T13:47:34Z
Summary
Updated botan packages fix security vulnerabilities
Details

Updated botan packages fix security vulnerabilities:

During RSA decryption, how long decoding of PKCS #1 v1.5 padding took was input dependent. If these differences could be measured by an attacker, it could be used to mount a Bleichenbacher million-message attack (CVE-2015-7827).

ECDSA (and DSA) signature algorithms perform a modular inverse on the signature nonce k. The modular inverse algorithm used had input dependent loops, and it is possible a side channel attack could recover sufficient information about the nonce to eventually recover the ECDSA secret key (CVE-2016-2849).

References
Credits

Affected packages

Mageia:5 / botan

Package

Name
botan
Purl
pkg:rpm/mageia/botan?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.12-1.1.mga5

Ecosystem specific 

{
    "section": "core"
}