Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12:Update
patchinfo.4627
_patchinfo
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _patchinfo of Package patchinfo.4627
<patchinfo incident="4627"> <issue id="965620" tracker="bnc">VUL-0: CVE-2016-2195: botan: various flaws fixed in 1.11.27 and 1.10.11</issue> <issue id="1033605" tracker="bnc">VUL-0: CVE-2017-2801: Botan: Incorrect comparison in X.509 DN strings</issue> <issue id="974521" tracker="bnc">VUL-0: CVE-2014-9742: Botan: A bug in the Miller-Rabin primality test resulted in only a single randombase being used instead of a sequence of such bases</issue> <issue id="965621" tracker="bnc">VUL-0: CVE-2016-2194: botan: various flaws fixed in 1.11.27 and 1.10.11</issue> <issue id="1013209" tracker="bnc">VUL-1: CVE-2016-9132: Botan: Integer overflow in BER decoder</issue> <issue id="977420" tracker="bnc">VUL-1: CVE-2016-2849: Botan: ECDSA side channel</issue> <issue id="968030" tracker="bnc">VUL-0: CVE-2015-7827: Botan: PKCS #1 v1.5 decoding was not constant time</issue> <issue id="968025" tracker="bnc">VUL-0: CVE-2015-5726: Botan: Crash in BER decoder</issue> <issue id="968026" tracker="bnc">VUL-0: CVE-2015-5727: Botan: Excess memory allocation in BER decoder</issue> <issue id="2015-5726" tracker="cve" /> <issue id="2015-5727" tracker="cve" /> <issue id="2016-2195" tracker="cve" /> <issue id="2016-2194" tracker="cve" /> <issue id="2017-2801" tracker="cve" /> <issue id="2015-7827" tracker="cve" /> <issue id="2016-2849" tracker="cve" /> <issue id="2016-9132" tracker="cve" /> <issue id="2014-9742" tracker="cve" /> <category>security</category> <rating>moderate</rating> <packager>dmolkentin</packager> <description> This update for Botan to version 1.10.9 fixes the following issues: These security issues were fixed: - CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data (bsc#968025). - CVE-2015-5727: The BER decoder in Botan 1.10.x allowed remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field (bsc#968026). - CVE-2015-7827: Botan make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding (bsc#968030). - CVE-2016-2849: Botan do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allowed remote attackers to obtain ECDSA secret keys via a timing side-channel attack (bsc#977420). - CVE-2016-9132: In Botan 1.8.0 when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later caused memory corruption or other failure (bsc#1013209). - CVE-2016-2194: The ressol function in Botan allowed remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus (bsc#965621). - CVE-2016-2195: Integer overflow in the PointGFp constructor in Botan allowed remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow (bsc#965620). - CVE-2017-2801: Incorrect comparison in X.509 DN strings (bsc#1033605). - CVE-2014-9742: The Miller-Rabin primality check in Botan improperly used a single random base, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group (bsc#974521). These non-security issues were fixed: - Fixed EAX tag verification to run in constant time - The default TLS policy now disables SSLv3. - A crash could have occured when reading from a blocking random device if the device initially indicated that entropy was available but a concurrent process drained the entropy pool before the read was initiated. - Fixed decoding indefinite length BER constructs that contain a context sensitive tag of zero. - The key length limit on HMAC has been raised to 512 bytes, allowing the use of very long passphrases with PBKDF2. - OAEP had two bugs, one of which allowed it to be used even if the key was too small, and the other of which would cause a crash during decryption if the EME data was too large for the associated key. </description> <summary>Security update for Botan</summary> </patchinfo>
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor