CVE-2021-40529: Medium severity Botan Project Botan vulnerability
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Botanto a version that resolves this vulnerability.Fixed in 2.18.1Patch 2.18.1
Event History
Frequently Asked Questions
What is CVE-2021-40529?
CVE-2021-40529 is a vulnerability in the ElGamal implementation in Botan through 2.18.1, which is used in Thunderbird and other products, allowing plaintext recovery.
Which software is affected by CVE-2021-40529?
Botan through 2.18.1, Thunderbird, Fedora 34, and Fedora 35 are affected by CVE-2021-40529.
What is the severity of CVE-2021-40529?
The severity of CVE-2021-40529 is medium with a CVSS (Common Vulnerability Scoring System) score of 5.9.
How can I fix CVE-2021-40529?
To fix CVE-2021-40529, update Botan to version 2.18.2 or later and update Thunderbird to version 91.13.0 or later.
Where can I find more information about CVE-2021-40529?
You can find more information about CVE-2021-40529 at the following references: [1](https://eprint.iacr.org/2021/923), [2](https://github.com/randombit/botan/pull/2790), [3](https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1).