CVE-2024-50382: Medium severity botan vulnerability
Published Oct 23, 2024
·Updated
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
Affected Software
2 affected components
Botan Botan<3.6.0
Botan Project Botan<3.6.0
Remediation
Event History
Oct 23, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-50382?
CVE-2024-50382 is a medium severity vulnerability due to compiler-induced secret-dependent control flow affecting AES-GCM in Botan.
2
How do I fix CVE-2024-50382?
To fix CVE-2024-50382, upgrade Botan to version 3.6.0 or later.
3
Which versions of Botan are affected by CVE-2024-50382?
CVE-2024-50382 affects Botan versions prior to 3.6.0.
4
What specific components of Botan are impacted by CVE-2024-50382?
CVE-2024-50382 impacts the GHASH implementation in the AES-GCM functionality of Botan.
5
What compilers are associated with CVE-2024-50382?
CVE-2024-50382 has been observed primarily when using Clang with LLVM 15 on RISC-V.