CVE-2017-14737 A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as de...
MediumCVSS 5.5
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| botan project botan | <= 1.10.16 | No fix listed |
| botan project botan | = 1.11.0 | No fix listed |
| botan project botan | = 1.11.1 | No fix listed |
| botan project botan | = 1.11.2 | No fix listed |
| botan project botan | = 1.11.3 | No fix listed |
| botan project botan | = 1.11.4 | No fix listed |
| botan project botan | = 1.11.5 | No fix listed |
| botan project botan | = 1.11.6 | No fix listed |
| botan project botan | = 1.11.7 | No fix listed |
| botan project botan | = 1.11.8 | No fix listed |
| botan project botan | = 1.11.9 | No fix listed |
| botan project botan | = 1.11.10 | No fix listed |
| botan project botan | = 1.11.11 | No fix listed |
| botan project botan | = 1.11.12 | No fix listed |
| botan project botan | = 1.11.13 | No fix listed |
| botan project botan | = 1.11.14 | No fix listed |
| botan project botan | = 1.11.15 | No fix listed |
| botan project botan | = 1.11.16 | No fix listed |
| botan project botan | = 1.11.17 | No fix listed |
| botan project botan | = 1.11.18 | No fix listed |
| botan project botan | = 1.11.19 | No fix listed |
| botan project botan | = 1.11.20 | No fix listed |
| botan project botan | = 1.11.21 | No fix listed |
| botan project botan | = 1.11.22 | No fix listed |
| botan project botan | = 1.11.23 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| botan project botan | = 1.11.24 | No fix listed |
| botan project botan | = 1.11.25 | No fix listed |
| botan project botan | = 1.11.26 | No fix listed |
| botan project botan | = 1.11.27 | No fix listed |
| botan project botan | = 1.11.28 | No fix listed |
| botan project botan | = 1.11.33 | No fix listed |
| botan project botan | = 1.11.34 | No fix listed |
| botan project botan | = 2.0.0 | No fix listed |
| botan project botan | = 2.0.1 | No fix listed |
| botan project botan | = 2.1.0 | No fix listed |
| botan project botan | = 2.2.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- github.com issue-tracking third-party-advisory
- [debian-lts-announce] 20211108 [SECURITY] [DLA 2812-1] botan1.10 security update mailing-list third-party-advisory
- www.usenix.org third-party-advisory