Every CVE Search/ Get API key

CVE-2021-40529

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products,...

5.9 MediumFix available

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.53%Up 0.5 points since Sep 7, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
CVE-2021-40529
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
CVE List No score

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
CVE-2021-40529
Updated
2026-11-02
EUVDEUVD-2021-27704 No score

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
EUVD-2021-27704
Updated
2026-11-03
GitHub AdvisoriesGHSA-f9qg-252f-g8cg 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products,...

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
GHSA-f9qg-252f-g8cg
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-327
Updated
2026-11-02
OSVALPINE-CVE-2021-40529 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
ALPINE-CVE-2021-40529
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
CVE-2021-40529
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2021-40529 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
DEBIAN-CVE-2021-40529
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-40529 5.9

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Record
UBUNTU-CVE-2021-40529
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2021-0563 No score

Updated botan2 packages fix security vulnerability

Updated botan2 packages fix security vulnerability:

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP (CVE-2021-40529).

Record
MGASA-2021-0563
Updated
2026-11-02
OSVopenSUSE-SU-2021:1635-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1635-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4150-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

Record
openSUSE-SU-2021:4150-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11661-1 No score

Botan-2.18.2-1.1 on GA media

These are all security issues fixed in the Botan-2.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11661-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11670-1 No score

MozillaThunderbird-91.4.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11670-1
Updated
2026-11-02
OSVSUSE-SU-2021:4150-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

Record
SUSE-SU-2021:4150-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
botan
Alpine:v3.14
 before 2.17.3-r3
2.17.3-r3
botan
Alpine:v3.15
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.16
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.17
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.18
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.19
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.20
 before 2.18.1-r3
2.18.1-r3
botan
Alpine:v3.21
 before 2.18.1-r3
2.18.1-r3
botan
Debian:12
 before 2.18.1+dfsg-3
2.18.1+dfsg-3
botan
Debian:13
 before 2.18.1+dfsg-3
2.18.1+dfsg-3
Show 13 moreShow less
Affected packages
PackageAffectedFixed
botan2
Mageia:8
 before 2.17.3-2.1.mga8
2.17.3-2.1.mga8
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 33 CVEs
 before 91.4.0-8.45.2
91.4.0-8.45.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 33 CVEs
 before 91.4.0-8.45.2
91.4.0-8.45.2
botan1.10
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.10.5-11.10.5-1ubuntu11.10.5-1+deb7u1ubuntu0.14.04.11.10.5-1+deb7u1ubuntu0.14.04.1+esm1
 None known
botan1.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.10-61.10.12-1
 None known
botan
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.0-32.4.0-42.4.0-5ubuntu1
 None known
botan1.10
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.10.16-11.10.17-0.1
 None known
botan
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.9.0-22.9.0-2build12.12.1-22.12.1-2build1
 None known
botan
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.17.3+dfsg-32.19.1+dfsg-2ubuntu12.19.1+dfsg-2ubuntu1+esm1
 None known
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 33 CVEs
 before 91.4.0-lp152.2.52.1
91.4.0-lp152.2.52.1
MozillaThunderbird
openSUSE:Leap 15.3
From an advisory covering 33 CVEs
 before 91.4.0-8.45.2
91.4.0-8.45.2
Botan
openSUSE:Tumbleweed
 before 2.18.2-1.1
2.18.2-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 91.4.0-1.1
91.4.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-40529 is a medium vulnerability (CVSS 5.9) in Botan Project Botan, published September 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in botan 2.17.3-r3.

References

Show 54 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open