CVE-2016-2849
- Source
- https://cve.org/CVERecord?id=CVE-2016-2849
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2849.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-2849
- Downstream
- Related
- Published
- 2016-05-13T14:59:10.713Z
- Modified
- 2026-05-18T05:48:14.948127647Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "last_affected": "8.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "vendor_product": "debian:debian_linux", "source": "CPE_FIELD" }, { "extracted_events": [ { "last_affected": "24" } ], "cpes": [ "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*" ], "vendor_product": "fedoraproject:fedora", "source": "CPE_FIELD" } ] }- References
Affected packages
Git / github.com/randombit/botan
Affected ranges
- Type
- GIT
- Repo
- https://github.com/randombit/botan
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.10.12" }, { "last_affected": "1.11.0" }, { "last_affected": "1.11.1" }, { "last_affected": "1.11.2" }, { "last_affected": "1.11.3" }, { "last_affected": "1.11.4" }, { "last_affected": "1.11.5" }, { "last_affected": "1.11.6" }, { "last_affected": "1.11.7" }, { "last_affected": "1.11.8" }, { "last_affected": "1.11.9" }, { "last_affected": "1.11.10" }, { "last_affected": "1.11.11" }, { "last_affected": "1.11.12" }, { "last_affected": "1.11.13" }, { "last_affected": "1.11.14" }, { "last_affected": "1.11.15" }, { "last_affected": "1.11.16" }, { "last_affected": "1.11.17" }, { "last_affected": "1.11.18" }, { "last_affected": "1.11.19" }, { "last_affected": "1.11.20" }, { "last_affected": "1.11.21" }, { "last_affected": "1.11.22" }, { "last_affected": "1.11.23" }, { "last_affected": "1.11.24" }, { "last_affected": "1.11.25" }, { "last_affected": "1.11.26" }, { "last_affected": "1.11.27" }, { "last_affected": "1.11.28" } ], "cpe": [ "cpe:2.3:a:botan_project:botan:1.10.12:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.2:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.3:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.4:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.5:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.6:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.7:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.8:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.9:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.10:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.11:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.12:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.14:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.15:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.16:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.17:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.18:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.19:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.20:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.21:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.22:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.23:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.24:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.25:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.26:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.27:*:*:*:*:*:*:*", "cpe:2.3:a:botan_project:botan:1.11.28:*:*:*:*:*:*:*" ], "source": "CPE_FIELD" }
Affected versions
1.*
1.10.0
1.10.0-rc1
1.10.1
1.10.11
1.10.12
1.10.2
1.10.3
1.10.5
1.10.6
1.10.8
1.10.9
1.11.0
1.11.1
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.16
1.11.17
1.11.18
1.11.19
1.11.2
1.11.20
1.11.21
1.11.22
1.11.23
1.11.24
1.11.25
1.11.26
1.11.27
1.11.28
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.1
1.7.0
1.7.1
1.7.10
1.7.11
1.7.15
1.7.16
1.7.17
1.7.18
1.7.19
1.7.20
1.7.21
1.7.22
1.7.23
1.7.24
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8
1.7.9
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.9.10
1.9.11
1.9.12
1.9.13
1.9.14
1.9.15
1.9.16
1.9.17
1.9.18
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9