MGASA-2020-0308
Updated botan2 packages fix security vulnerability
The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length alone might be used to make inferences about the contents. This issue affects TLS CBC ciphersuites as well as CBC encryption using PKCS7 or other similar padding mechanisms. In all cases, the unpadding operations were already constant time and are not affected (rhbz#1849743).
What each source reports
OSV No score
Updated botan2 packages fix security vulnerability
The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length alone might be used to make inferences about the contents. This issue affects TLS CBC ciphersuites as well as CBC encryption using PKCS7 or other similar padding mechanisms. In all cases, the unpadding operations were already constant time and are not affected (rhbz#1849743).
- Record
MGASA-2020-0308- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
botan2Mageia:7 |
before 2.9.0-2.1.mga7 | 2.9.0-2.1.mga7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2020-0308 is a vulnerability with no CVSS score yet in botan2, published July 31, 2020. No source lists public exploit code. Fixed in botan2 2.9.0-2.1.mga7.