CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.

References

Affected packages

Debian:11 / botan

Package

Name: botan
Purl: pkg:deb/debian/botan?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.17.3+dfsg-2

2.17.3+dfsg-3

2.18.1+dfsg-1

2.18.1+dfsg-2

2.18.1+dfsg-3

2.18.2+dfsg-1

2.19.1+dfsg-1

2.19.1+dfsg-2

2.19.1+dfsg-3

2.19.2+dfsg-1

2.19.3+dfsg-1

2.19.4+dfsg-1

2.19.5+dfsg-1

2.19.5+dfsg-2

2.19.5+dfsg-3

2.19.5+dfsg-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / botan

Package

Name: botan
Purl: pkg:deb/debian/botan?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.19.3+dfsg-1

2.19.4+dfsg-1

2.19.5+dfsg-1

2.19.5+dfsg-2

2.19.5+dfsg-3

2.19.5+dfsg-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / botan

Package

Name: botan
Purl: pkg:deb/debian/botan?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.19.5+dfsg-3

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:14 / botan

Package

Name: botan
Purl: pkg:deb/debian/botan?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.19.5+dfsg-3

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/randombit/botan

Affected ranges

Type: GIT
Repo: https://github.com/randombit/botan
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

53b0cfde580e86b03d0d27a488b6c134f662e957

Affected versions

1.*

1.10.0

1.10.0-rc1

1.10.1

1.11.0

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.29

1.11.3

1.11.30

1.11.31

1.11.32

1.11.33

1.11.34

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

1.7.1

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.2

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.9.0

1.9.1

1.9.10

1.9.11

1.9.12

1.9.13

1.9.14

1.9.15

1.9.16

1.9.17

1.9.18

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

2.*

2.0.0

2.0.1

2.1.0

2.10.0

2.11.0

2.12.0

2.12.1

2.13.0

2.14.0

2.15.0

2.16.0

2.17.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.8.0

2.9.0

3.*

3.0.0

3.0.0-alpha0

3.0.0-alpha1

3.0.0-rc1

3.1.0

3.1.1

3.2.0

3.3.0

3.4.0

3.5.0