Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka
    the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and
    ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a
    different virtual machine on the same physical host. (CVE-2018-12435)

Update Botan2 to 2.7.0.

Focus of this release is on performance and side channel hardening.

  - Address side channels in RSA key generation and ECDSA     signing

  - Side channel hardening in many core algorithms (modular     exponentiation, ECC scalar multiply, Karatsuba     multiplication, Barrett reduction, etc) to reduce the     risk of future exploitable side channels.

  - Many optimizations for ECC operations, RSA (including     key gen), DSA, DH, and XMSS. Typical speedups vs 2.6.0     is 10 to 40% depending on operation and key size.

  - Add Scrypt password hashing. Also supported is using     Scrypt to derive keys for private key encryption (format     compatible with upcoming OpenSSL 1.1.1)

  - Add base32 encoding/decoding

  - Plus many bug fixes and smaller enhancements documented     in the [release     notes](https://botan.randombit.net/news.html#version-2-7
    -0-2018-07-02)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

botan2 developers report :

A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.

Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.

ID	Name	Product	Family	Severity
423723	Alpine: multiple botan packages: security update to 2.7.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423723	Alpine: multiple botan packages: security update to 2.7.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
120879	Fedora 28 : botan2 (2018-eaa7de17ae)	Nessus	Fedora Local Security Checks	medium
111991	FreeBSD : botan2 -- ECDSA side channel (7762d7ad-2e38-41d2-9785-c51f653ba8bd)	Nessus	FreeBSD Local Security Checks	medium
111016	Fedora 27 : botan2 (2018-98ab6b4e56)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-12435

medium

Tenable Plugins

medium

medium

medium

medium

medium