CVE-2024-50382
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in A...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-50382 botan
- Ubuntu UBUNTU-CVE-2024-50382 botan
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web arxiv.org
- web github.com
- web news.ycombinator.com