SB2018071624 - Information disclosure in botan (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) Information disclosure (CVE-ID: CVE-2018-12435)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists in the Botan library due to a leakage of information through memory caches when the library uses a private key to create Elliptic Curve Digital Signature Algorithm (ECDSA) signatures as demonstrayed in the dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp source code files. A local attacker can conduct a memory-cache side-channel attack and recover sensitive information, such ECDSA private keys, which could be used to conduct further attacks.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=1c18797cef1fa8638c3386991406611d0e17ea19
• https://git.alpinelinux.org/aports/commit/?id=fa338c84f5c186bc45440fbb16c0152cc763faf7