Bertram Poettering

**Name of the Vulnerable Software and Affected Versions** Botan versions through 2.18.1 **Description** The issue allows plaintext recovery due to a certain combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents, leading to a cross-configuration attack against OpenPGP. **Recommendations** For Botan versions through 2.18.1, update to a version later than 2.18.1 to resolve the issue. As a temporary workaround, consider restricting the use of the ElGamal implementation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Crypto++ versions through 8.5 **Description** The ElGamal implementation in Crypto++ allows plaintext recovery due to a certain combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents. This can lead to a cross-configuration attack against OpenPGP. **Recommendations** For Crypto++ versions through 8.5, consider updating to a version that addresses this issue, as the current implementation allows for plaintext recovery. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Libgcrypt versions prior to 1.9.4 **Description** The issue is related to the use of a weak cryptographic algorithm in the Libgcrypt library. It affects the ElGamal implementation, allowing plaintext recovery due to a dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents. This can lead to a cross-configuration attack against OpenPGP. **Recommendations** For Libgcrypt versions prior to 1.9.4, update to version 1.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ElGamal implementation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TLS protocol (affected versions not specified) SSL protocol (affected versions not specified) **Description** The issue concerns the RC4 algorithm used in the TLS and SSL protocols, which contains single-byte biases. This weakness allows remote attackers to potentially recover plaintext through statistical analysis of ciphertext in multiple sessions that utilize the same plaintext. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.