Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

The remote host is affected by the vulnerability described in GLSA-201701-23 (Botan: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Botan. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might obtain ECDSA secret keys via a timing       side-channel attack or could possibly bypass TLS policy.
  Workaround :

    There is no known workaround at this time.

From the upstream release notes :

Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jack Lloyd reports :

Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

><i>From the upstream release notes: Botan 1.10.13 has been released backporting </I>some side channel protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA decryption (CVE-2015-7827).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs.

  - CVE-2015-5726     The BER decoder would crash due to reading from offset 0     of an empty vector if it encountered a BIT STRING which     did not contain any data at all. This can be used to     easily crash applications reading untrusted ASN.1 data,     but does not seem exploitable for code execution.

  - CVE-2015-5727     The BER decoder would allocate a fairly arbitrary amount     of memory in a length field, even if there was no chance     the read request would succeed. This might cause the     process to run out of memory or invoke the OOM killer.

  - CVE-2015-7827     Use constant time PKCS #1 unpadding to avoid possible     side channel attack against RSA decryption

  - CVE-2016-2194     Infinite loop in modular square root algorithm. The     ressol function implementing the Tonelli-Shanks     algorithm for finding square roots could be sent into a     nearly infinite loop due to a misplaced conditional     check. This could occur if a composite modulus is     provided, as this algorithm is only defined for primes.
    This function is exposed to attacker controlled input     via the OS2ECP function during ECC point decompression.

  - CVE-2016-2195     Fix Heap overflow on invalid ECC point.

  - CVE-2016-2849     Use constant time modular inverse algorithm to avoid     possible side channel attack against ECDSA.

ID	Name	Product	Family	Severity
96417	GLSA-201701-23 : Botan: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
92216	Fedora 22 : botan (2016-fe0d8f126a)	Nessus	Fedora Local Security Checks	high
92200	Fedora 23 : botan (2016-f2aae0dbc5)	Nessus	Fedora Local Security Checks	high
91582	FreeBSD : botan -- multiple vulnerabilities (ac0900df-31d0-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
90969	Fedora 24 : botan-1.10.13-1.fc24 (2016-a545f81683)	Nessus	Fedora Local Security Checks	high
90841	Debian DSA-3565-1 : botan1.10 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-2849

high

Tenable Plugins

high

high

high

high

high

critical