CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50382.json"
}

References

Affected packages

Git / github.com/randombit/botan

Affected ranges

Type

GIT

Repo

https://github.com/randombit/botan

Events

Introduced

Fixed

76a8996c624624f5bb68fe224554cb58ad860371

Fixed

53b0cfde580e86b03d0d27a488b6c134f662e957

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.0"
        }
    ],
    "cpe": "cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.10.0

1.10.0-rc1

1.10.1

1.11.0

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.29

1.11.3

1.11.30

1.11.31

1.11.32

1.11.33

1.11.34

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.7.0

1.7.1

1.7.10

1.7.11

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.9.10

1.9.11

1.9.12

1.9.13

1.9.14

1.9.15

1.9.16

1.9.17

1.9.18

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

2.*

2.0.0

2.0.1

2.1.0

2.10.0

2.11.0

2.12.0

2.12.1

2.13.0

2.14.0

2.15.0

2.16.0

2.17.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.8.0

2.9.0

3.*

3.0.0

3.0.0-alpha0

3.0.0-alpha1

3.0.0-rc1

3.1.0

3.1.1

3.2.0

3.3.0

3.4.0

3.5.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50382.json"