920284 – (CVE-2023-50979, CVE-2023-50980, CVE-2023-50981) dev-libs/crypto++: multiple vulnerabilities

Bug 920284 (CVE-2023-50979, CVE-2023-50980, CVE-2023-50981) - dev-libs/crypto++: multiple vulnerabilities

Summary: dev-libs/crypto++: multiple vulnerabilities

Status:	CONFIRMED

Alias:	CVE-2023-50979, CVE-2023-50980, CVE-2023-50981

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:	https://github.com/weidai11/cryptopp/...
Whiteboard:	B3 [upstream/ebuild]
Keywords:

Depends on:
Blocks:

Reported:	2023-12-18 19:55 UTC by Christopher Fore
Modified:	2024-01-07 08:14 UTC (History)
CC List:	1 user (show)

See Also:	https://github.com/weidai11/cryptopp/issues/1247 https://github.com/weidai11/cryptopp/issues/1248 https://github.com/weidai11/cryptopp/issues/1249
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Christopher Fore 2023-12-18 19:55:12 UTC

CVE-2023-50979 (https://github.com/weidai11/cryptopp/issues/1247):

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

CVE-2023-50980 (https://github.com/weidai11/cryptopp/issues/1248):

gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.

CVE-2023-50981 (https://github.com/weidai11/cryptopp/issues/1249):

ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.