Use of a broken or risky cryptographic algorithm in Botan - CVE-2021-40529

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU66482

Use of a broken or risky cryptographic algorithm in Botan - CVE-2021-40529

Published: August 15, 2022


Vulnerability identifier: #VU66482
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-40529
CWE-ID: CWE-327
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect ElGamal implementation in Botan, which allows plaintext recovery. A remote attacker can perform a cross-configuration attack against OpenPGP and recover encrypted data.


Affected software

Botan
Gentoo Linux
SUSE Linux Enterprise Workstation Extension
Fedora
botan2
MozillaThunderbird
MozillaThunderbird-debuginfo
MozillaThunderbird-debugsource
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other
mail-client/thunderbird
mail-client/thunderbird-bin

How to mitigate CVE-2021-40529

Install updates from vendor's website.

Botan - update to 2.18.2
botan2 - addressed in versions 2.17.3-4.fc34, 2.18.2-1.fc35
MozillaThunderbird - update to 91.4.0-8.45.2
MozillaThunderbird-debuginfo - update to 91.4.0-8.45.2
MozillaThunderbird-debugsource - update to 91.4.0-8.45.2
MozillaThunderbird-translations-common - update to 91.4.0-8.45.2
MozillaThunderbird-translations-other - update to 91.4.0-8.45.2
mail-client/thunderbird - update to 91.12.0
mail-client/thunderbird-bin - update to 91.12.0

External References

Related Security Bulletins