A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the     time taken for ECC key generation may be able to derive information about the high bits of the secret key,     as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder     whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation,     not ECDSA signatures or ECDH key agreement. (CVE-2018-20187)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the
    time taken for ECC key generation may be able to derive information about the high bits of the secret key,
    as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder
    whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation,
    not ECDSA signatures or ECDH key agreement. (CVE-2018-20187)

Update to 2.9.0 including security fix for CVE-2018-20187

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

botan2 developers reports :

A timing side channel during ECC key generation could leak information about the high bits of the secret scalar. Such information allows an attacker to perform a brute-force attack on the key somewhat more efficiently than they would otherwise. Found by Jan Jancar using ECTester.

Bug introduced in 1.11.20, fixed in 2.9.0

ID	Name	Product	Family	Severity
254650	Linux Distros Unpatched Vulnerability : CVE-2018-20187	Nessus	Misc.	medium
423726	Alpine: multiple botan packages: security update to 2.9.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423726	Alpine: multiple botan packages: security update to 2.9.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400632	Alpine: Botan: security update to 2.8.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400632	Alpine: Botan: security update to 2.8.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
122324	Fedora 29 : botan2 (2019-e0f5a82082)	Nessus	Fedora Local Security Checks	medium
121407	FreeBSD : botan2 -- Side channel during ECC key generation (d8e7e854-17fa-11e9-bef6-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-20187

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium