FEDORA-EPEL-2017-17b77b3268

security update in Fedora EPEL 7 for botan

Status: stable 2 years ago

Version 1.10.17, 2017-10-02

  • Address a side channel affecting modular exponentiation. An attacker capable of a local or cross-VM cache analysis attack may be able to recover bits of secret exponents as used in RSA, DH, etc. (CVE-2017-14737)
  • Workaround a miscompilation bug in GCC 7 on x86-32 affecting GOST-34.11 hash function. GH #1192 GH #1148 GH #882
  • Add SecureVector::data() function which returns the start of the buffer. This makes it slightly simpler to support both 1.10 and 2.x APIs in the same codebase.
  • When compiled by a C++11 (or later) compiler, a template typedef of SecureVector, secure_vector, is added. In 2.x this class is a std::vector with a custom allocator, so has a somewhat different interface than SecureVector in 1.10. But this makes it slightly simpler to support both 1.10 and 2.x APIs in the same codebase.
  • Fix a bug that prevented configure.py from running under Python3
  • Botan 1.10.x does not support the OpenSSL 1.1 API. Now the build will #error if OpenSSL 1.1 is detected. Avoid –with-openssl if compiling against 1.1 or later. GH #753
  • Import patches from Debian adding basic support for building on aarch64, ppc64le, or1k, and mipsn32 platforms.

Version 1.10.16, 2017-04-04

  • Fix a bug in X509 DN string comparisons that could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. (CVE-2017-2801)
  • Avoid throwing during a destructor since this is undefined in C++11 and rarely a good idea. GH #930

Version 1.10.15, 2017-01-12

  • Fix a bug causing modular exponentiations done modulo even numbers to almost always be incorrect, unless the values were small. This bug is not known to affect any cryptographic operation in Botan. GH #754
  • Avoid use of C++11 std::to_string in some code added in 1.10.14 GH #747 GH #834

Comments 10

This update has been submitted for testing by thm.

This update has been pushed to testing.

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

thm edited this update.

New build(s):

  • botan-1.10.17-1.el7

Removed build(s):

  • botan-1.10.16-1.el7

Karma has been reset.

This update has been submitted for testing by thm.

This update has been pushed to testing.

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

This update has been submitted for batched by thm.

This update has been submitted for stable by bodhi.

This update has been pushed to stable.

Add Comment & Feedback

Please login to add feedback.

Content Type
RPM
Status
stable
Test Gating
Submitted by
Update Type
security
Update Severity
unspecified
Karma
0
stable threshold: 3
unstable threshold: -3
Autopush (karma)
Enabled
Autopush (time)
Disabled
Dates
submitted 2 years ago
in testing 2 years ago
in stable 2 years ago
modified 2 years ago

Related Bugs 4

00 #1441126 CVE-2017-2801 botan: Incorrect comparison in X.509 DN strings
00 #1441128 CVE-2017-2801 botan: Incorrect comparison in X.509 DN strings [epel-7]
00 #1496368 CVE-2017-14737 botan: cryptographic cache-based side channel in the RSA implementation
00 #1496369 CVE-2017-14737 botan: cryptographic cache-based side channel in the RSA implementation [epel-all]

Automated Test Results