UBUNTU-CVE-2018-20187

    Dashboard / Vulnerabilities / UBUNTU-CVE-2018-20187

    UBUNTU-CVE-2018-20187

    Published: 8 Mar 2019Last Modified: 22 Apr 2026
    Upstream:
    CVE-2018-20187

    Summary:

    Details: A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.

    References: https://ubuntu.com/security/CVE-2018-20187, https://github.com/randombit/botan/pull/1792, https://github.com/randombit/botan/commit/70aa7303acfff9eefc24598c289a84db3579ebd1, https://www.cve.org/CVERecord?id=CVE-2018-20187

    Affected packages

    Package

    Name: botan1.10

    Purl: pkg:deb/ubuntu/[email protected]+deb7u1ubuntu0.14.04.1+esm1?arch=source&distro=esm-infra-legacy/trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.10.5-1
    1.10.5-1ubuntu1
    1.10.5-1+deb7u1ubuntu0.14.04.1
    1.10.5-1+deb7u1ubuntu0.14.04.1+esm1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2018-20187 | CVE-DB