PT-2016-7602
CVE-2016-8871
·
Published
2016-10-28
·
Updated
2016-11-29
Description by
CVSS 3.1
6.2
MediumMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Botan versions 1.11.29 through 1.11.32
Description
The issue concerns a detectable timing channel in RSA decryption with certain padding options. This could potentially allow an attacker to recover plaintext through an "OAEP side channel" attack, given sufficient queries.
Recommendations
For versions 1.11.29 through 1.11.32, consider updating to a version that fixes the timing channel issue in RSA decryption to prevent potential plaintext recovery attacks.
Found an issue in the description? Have something to add? Feel free to write us 👾