CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding...
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
CVE-2021-24115- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
CVE-2021-24115- Updated
- 2026-11-02
EUVDEUVD-2021-11030 No score
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
EUVD-2021-11030- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj2q-f8cp-cqmf
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding...
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
GHSA-cj2q-f8cp-cqmf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALPINE-CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
ALPINE-CVE-2021-24115- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-44961
CVE-2021-24115 affecting package botan2 2.14.0-2
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
AZL-44961- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
Show 6 moreShow less
OSV
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
CVE-2021-24115- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
DEBIAN-CVE-2021-24115- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
- Record
UBUNTU-CVE-2021-24115- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0329 No score
Updated botan2 packages fix security vulnerability
Updated botan2 packages fix security vulnerability:
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex) (CVE-2021-24115).
- Record
MGASA-2021-0329- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0765-1 No score
Security update for Botan
This update for Botan fixes the following issues:
- CVE-2021-24115 In Botan before 2.17.3, or this backport, constant-time computations are not used for certain decoding and encoding operations (boo#1182670)
- Record
openSUSE-SU-2021:0765-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0794-1 No score
Security update for Botan
This update for Botan fixes the following issues:
- CVE-2021-24115 In Botan before 2.17.3, or this backport, constant-time computations are not used for certain decoding and encoding operations (boo#1182670)
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0794-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
botanAlpine:v3.11 |
before 2.11.0-r4 | 2.11.0-r4 |
botanAlpine:v3.12 |
before 2.11.0-r6 | 2.11.0-r6 |
botanAlpine:v3.13 |
before 2.11.0-r6 | 2.11.0-r6 |
botanAlpine:v3.14 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.15 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.16 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.17 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.18 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.19 |
before 2.17.3-r0 | 2.17.3-r0 |
botanAlpine:v3.20 |
before 2.17.3-r0 | 2.17.3-r0 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
botanAlpine:v3.21 |
before 2.17.3-r0 | 2.17.3-r0 |
botan2Azure Linux:3 |
through 2.14.0-2 | None known |
botanDebian:12 |
before 2.17.3+dfsg-1 | 2.17.3+dfsg-1 |
botanDebian:13 |
before 2.17.3+dfsg-1 | 2.17.3+dfsg-1 |
botan2Mageia:7 |
before 2.9.0-2.2.mga7 | 2.9.0-2.2.mga7 |
botan1.10Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.5-11.10.5-1ubuntu11.10.5-1+deb7u1ubuntu0.14.04.11.10.5-1+deb7u1ubuntu0.14.04.1+esm1 |
None known |
botan1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.10-61.10.12-1 |
None known |
botanUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.0-32.4.0-42.4.0-5ubuntu1 |
None known |
botan1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10.16-11.10.17-0.1 |
None known |
botanUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.0-22.9.0-2build12.12.1-22.12.1-2build1 |
None known |
BotanSUSE:Package Hub 15 SP1 |
before 2.10.0-bp152.4.3.1 | 2.10.0-bp152.4.3.1 |
BotanSUSE:Package Hub 15 SP2 |
before 2.10.0-bp152.4.3.1 | 2.10.0-bp152.4.3.1 |
BotanopenSUSE:Leap 15.2 |
before 2.10.0-bp152.4.3.1 | 2.10.0-bp152.4.3.1 |
BotanSUSE:Package Hub 15 SP2 |
before 2.10.0-bp152.4.6.1 | 2.10.0-bp152.4.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24115 is a critical vulnerability (CVSS 9.8) in Botan Project Botan, published February 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. Fixed in botan 2.11.0-r4.
References
github.com/randombit/botan/compare/2.17.2...2.17.3
botan.randombit.net/news.html
nvd.nist.gov/vuln/detail/CVE-2021-24115
security.alpinelinux.org/vuln/CVE-2021-24115
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2021-24115
advisories.mageia.org/MGASA-2021-0329.html
bugs.mageia.org/show_bug.cgi?id=29057
lists.opensuse.org/archives/list/[email protected]/thread/66VDUR6MFH345POI2NK4EL4N3NCJVT5O
ubuntu.com/security/CVE-2021-24115
cve.org/CVERecord?id=CVE-2021-24115
bugzilla.suse.com/1182670
suse.com/security/cve/CVE-2021-24115