ALPINE-CVE-2021-40529
Dashboard / Vulnerabilities / ALPINE-CVE-2021-40529
Summary:
Details: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Affected packages
Package
Name: botan
Purl: pkg:apk/alpine/botan?arch=source
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -2.17.3-r3
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
