CVE-2021-40529

Katalog CVE

CVSS 5.9 · Medium EPSS 1,5%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada botan project botan, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Rincian

Terbit di NVD

6 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/randombit/botan/pull/2790 patch · advisory pihak ketiga
• https://eprint.iacr.org/2021/923 deskripsi teknis · advisory pihak ketiga
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 advisory pihak ketiga
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-14 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72NB4OLD3VHJC...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPHGYWNJQKWLT...