Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 920284 (CVE-2023-50979, CVE-2023-50980, CVE-2023-50981) - dev-libs/crypto++: multiple vulnerabilities
Summary: dev-libs/crypto++: multiple vulnerabilities
Status: CONFIRMED
Alias: CVE-2023-50979, CVE-2023-50980, CVE-2023-50981
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://github.com/weidai11/cryptopp/...
Whiteboard: B3 [upstream/ebuild]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-18 19:55 UTC by Christopher Fore
Modified: 2024-01-07 08:14 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Fore 2023-12-18 19:55:12 UTC
CVE-2023-50979 (https://github.com/weidai11/cryptopp/issues/1247):

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

CVE-2023-50980 (https://github.com/weidai11/cryptopp/issues/1248):

gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.

CVE-2023-50981 (https://github.com/weidai11/cryptopp/issues/1249):

ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.