CVE-2024-50382
EUVD-2024-4483523.10.2024, 17:15
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| botan_project | botan | 𝑥 < 3.6.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| botan |
| ||||||||||||||
| oscar |
| ||||||||||||||
| thunderbird |
|