Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.

From the upstream release notes :

Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jack Lloyd reports :

Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

><i>From the upstream release notes: Botan 1.10.13 has been released backporting </I>some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs.

  - CVE-2015-5726     The BER decoder would crash due to reading from offset 0     of an empty vector if it encountered a BIT STRING which     did not contain any data at all. This can be used to     easily crash applications reading untrusted ASN.1 data,     but does not seem exploitable for code execution.

  - CVE-2015-5727     The BER decoder would allocate a fairly arbitrary amount     of memory in a length field, even if there was no chance     the read request would succeed. This might cause the     process to run out of memory or invoke the OOM killer.

  - CVE-2015-7827     Use constant time PKCS #1 unpadding to avoid possible     side channel attack against RSA decryption

  - CVE-2016-2194     Infinite loop in modular square root algorithm. The     ressol function implementing the Tonelli-Shanks     algorithm for finding square roots could be sent into a     nearly infinite loop due to a misplaced conditional     check. This could occur if a composite modulus is     provided, as this algorithm is only defined for primes.
    This function is exposed to attacker controlled input     via the OS2ECP function during ECC point decompression.

  - CVE-2016-2195     Fix Heap overflow on invalid ECC point.

  - CVE-2016-2849     Use constant time modular inverse algorithm to avoid     possible side channel attack against ECDSA.

ID	Name	Product	Family	Severity
92216	Fedora 22 : botan (2016-fe0d8f126a)	Nessus	Fedora Local Security Checks	high
92200	Fedora 23 : botan (2016-f2aae0dbc5)	Nessus	Fedora Local Security Checks	high
91582	FreeBSD : botan -- multiple vulnerabilities (ac0900df-31d0-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
90969	Fedora 24 : botan-1.10.13-1.fc24 (2016-a545f81683)	Nessus	Fedora Local Security Checks	high
90841	Debian DSA-3565-1 : botan1.10 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-7827

high

Tenable Plugins

high

high

high

high

critical