Unrated
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction b...
CVE-2021-40529
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-40529 botan Fixed in: 2.17.3-r3
- Debian DEBIAN-CVE-2021-40529 botan Fixed in: 2.18.1+dfsg-3
Original description The description as published by the source.
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
References
- advisory eprint.iacr.org
- advisory ibm.github.io
- advisory security.gentoo.org
- patch github.com
- report ibm.github.io
- web lists.fedoraproject.org
- web lists.fedoraproject.org