[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 2812-1] botan1.10 security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2812-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Anton Gladky
November 08, 2021                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : botan1.10
Version        : 1.10.17-1+deb9u1
CVE ID         : CVE-2017-14737

One security issue has been discovered in botan1.10: a C++ cryptography
library.


An attacker of a local or a cross-VM may be able to recover bits of
secret exponents as used in RSA, DH, etc. with help of cache analysis.
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai

For Debian 9 stretch, this problem has been fixed in version
1.10.17-1+deb9u1.

We recommend that you upgrade your botan1.10 packages.

For the detailed security status of botan1.10 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/botan1.10

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmGJlfsACgkQ0+Fzg8+n
/waTvxAAmViY/mHlK+e6Bs3JwfiFbtBixUxnfnaIF+byn7QGjoWCQhcKMP/QrPiO
x4KU0S/88634P5t0Kd7VtGxAPKAuS9u4U2GzbED3LNqWkE6YIsK0TqJTXGDT/Q3o
dEFWp7pHuG5nAP4pPJ9xTPXZfaF0gI+/HgetPUxB026qvhl/iaveEvzyyH94Yc9J
0lZSEnyC3tymRM9/8RlvthQIVDiZENMZHvTH7Alyn+yu3VEGkRCWlY+mfPSqSHUS
Qa0XNAzNEQXeYKY/1OUmNbxjHX8scy9H2rlchs/+G63lgY6oS29ZKCf2ON36gCes
/zVWzPCAhy1iIr6QPDSx8zpkHp4Y4t7da98WUTW72hsrHEVGKZXI1IwD52QbQxUq
y76k4fiKIcP0TcoRVyXjCFW/+0fgEI+hMHiA0tM8iuas4wTBYD9D+iuRijaBYWKB
/cO73DpBvurXmLZNFBfN0PxIY8paw3ru1pZE9VA8dixauE3jIYTcwDIj5hEvkrG9
2u9qQBNnm06C9eXuu9F1jBI3HNgZX9cRyJL8/ig3J8rbBq9OrI2z2ssztXf+3Gp5
HZL5aqp0PoRxmnUasgOucbrgJEcz7W15F6mceRy6PoSeknX7xZVvB+CR0qGxBtH7
MI6NBxhB3dQUsry6gUlerBJYY6Yd+oSZk2+Ujb+8936adhW8y+E=
=xXmx
-----END PGP SIGNATURE-----


Reply to: