CVE-2018-9860 An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation ex...
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/botan(Debian:12) | < 2.4.0-6 | 2.4.0-6 |
| debian/botan(Debian:13) | < 2.4.0-6 | 2.4.0-6 |
| botan project botan | >= 1.11.32, < 2.6.0 | 2.6.0 |
| alpine/botan(Alpine:v3.10) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.11) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.12) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.13) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.14) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.15) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.16) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.17) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.18) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.19) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.20) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
| alpine/botan(Alpine:v3.21) | >= 1.11.32, < 2.6.0-r0 | 2.6.0-r0 |
References
- Debian Security Tracker CVE-2018-9860 vendor-advisory
- botan.randombit.net vendor-advisory
- bugs.chromium.org issue-tracking
- security.alpinelinux.org vendor-advisory