{"id":"CVE-2024-50382","aliases":["AZL-51678","AZL-51707","DEBIAN-CVE-2024-50382","EUVD-2024-44835","GHSA-p27h-83pf-6hh9","OESA-2024-2328","OESA-2024-2329","OESA-2024-2330","ROOT-OS-ALPINE-319-CVE-2024-50382","ROOT-OS-ALPINE-320-CVE-2024-50382","UBUNTU-CVE-2024-50382","USN-7586-1","openSUSE-SU-2024:0343-1","openSUSE-SU-2024:14429-1"],"status":"published","title":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent...","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00549,"percentile":0.46316,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2024-10-23T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"botan","fixed_in":["2.19.3+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"botan","fixed_in":["2.19.5+dfsg-3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"botan2","fixed_in":["2.19.3-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"botan2","fixed_in":["2.19.3-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"botan2","fixed_in":["2.19.3-4.oe2403"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"botan","fixed_in":["2.19.5-r00071","2.19.5-r00072","2.19.5-r00073","2.19.5-r00074","2.19.5-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.19","package":"rootio-botan","fixed_in":["2.19.5-r00071","2.19.5-r00072","2.19.5-r00073","2.19.5-r00074","2.19.5-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"botan","fixed_in":["2.19.5-r00072","2.19.5-r00073","2.19.5-r00075","2.19.5-r00074","2.19.5-r00076"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-botan","fixed_in":["2.19.5-r00072","2.19.5-r00073","2.19.5-r00075","2.19.5-r00074","2.19.5-r00076"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"botan","fixed_in":["2.19.1+dfsg-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"botan","fixed_in":["2.19.3+dfsg-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"Botan","fixed_in":["3.6.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3+dfsg-1+deb12u1"}]}],"versions":["2.19.3+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5+dfsg-3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-4.oe2403"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r00071"},{"fixed":"2.19.5-r00072"},{"fixed":"2.19.5-r00073"},{"fixed":"2.19.5-r00074"},{"fixed":"2.19.5-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.19","package":"rootio-botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r00071"},{"fixed":"2.19.5-r00072"},{"fixed":"2.19.5-r00073"},{"fixed":"2.19.5-r00074"},{"fixed":"2.19.5-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r00072"},{"fixed":"2.19.5-r00073"},{"fixed":"2.19.5-r00075"},{"fixed":"2.19.5-r00074"},{"fixed":"2.19.5-r00076"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-r00072"},{"fixed":"2.19.5-r00073"},{"fixed":"2.19.5-r00075"},{"fixed":"2.19.5-r00074"},{"fixed":"2.19.5-r00076"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-3","2.4.0-4","2.4.0-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.0-2","2.9.0-2build1","2.12.1-2","2.12.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-testing-3-1","1.1.0-testing-3-2","1.1.0-testing-3-3","1.1.0-testing-3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.3.0-1","1.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.1+dfsg-2ubuntu1+esm1"}]}],"versions":["2.17.3+dfsg-3","2.19.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.5.1-1","1.5.1-1build1","1.5.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3+dfsg-1ubuntu2+esm1"}]}],"versions":["2.19.3+dfsg-1ubuntu1","2.19.3+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-2build1","1.5.3-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"oscar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-2","1.5.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.1+dfsg-2ubuntu1+esm1"}]}],"versions":["2.17.3+dfsg-3","2.19.1+dfsg-2ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3+dfsg-1ubuntu2+esm1"}]}],"versions":["2.19.3+dfsg-1ubuntu1","2.19.3+dfsg-1ubuntu2"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-bp156.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-bp156.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-bp156.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.5-bp156.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1.1"}]}]}],"products":[{"vendor":"botan_project","product":"botan"}],"references":[{"url":"https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957","tags":["Patch","fix"]},{"url":"https://github.com/randombit/botan/compare/3.5.0...3.6.0","tags":["Product","web","report"]},{"url":"https://arxiv.org/pdf/2410.13489","tags":["Exploit","Technical Description","Third Party Advisory","web","report"]},{"url":"https://news.ycombinator.com/item?id=41887153","tags":["Issue Tracking","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50382","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p27h-83pf-6hh9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50382.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-50382","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2328","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2329","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2330","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-50382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50382","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7586-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-34702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50383","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JIB3PGKG47QR6R5PTCZJFDYCEELC6BOJ/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232296","tags":["report"]},{"url":"https://bugzilla.suse.com/1232297","tags":["report"]},{"url":"https://bugzilla.suse.com/1232300","tags":["report"]},{"url":"https://bugzilla.suse.com/1232301","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50383","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UY4RL4FBV22PQSJS56OEWPJTGWTDJO2U/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-50382","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T00:00:00Z","modified":"2024-10-24T19:57:23.462Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-44835","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T00:00:00Z","modified":"2024-10-24T19:57:23Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:19.50919Z"}],"ghsa":[{"id":"GHSA-p27h-83pf-6hh9","title":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent...","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T18:33:08Z","modified":"2024-10-24T21:32:08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:58:35.988972Z"}],"nvd":[{"id":"CVE-2024-50382","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T17:15:19.453Z","modified":"2026-06-17T08:04:20.99Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:10:33.928543Z"}],"osv":[{"id":"CVE-2024-50382","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T00:00:00Z","modified":"2026-10-28T10:54:40.640224908Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-50382","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T17:15:19.453Z","modified":"2026-11-02T12:03:06.787248018Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"OESA-2024-2328","title":"botan2 security update","description":"Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \\#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API reference, tutorial, and examples may help impart the flavor of the library. This is the current stable release branch 2.x of Botan.\r\n\r\nSecurity Fix(es):\r\n\r\nBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.(CVE-2024-50382)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:37.319203899Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2329","title":"botan2 security update","description":"Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \\#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API reference, tutorial, and examples may help impart the flavor of the library. This is the current stable release branch 2.x of Botan.\r\n\r\nSecurity Fix(es):\r\n\r\nBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.(CVE-2024-50382)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:37.336550197Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2330","title":"botan2 security update","description":"Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \\#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API reference, tutorial, and examples may help impart the flavor of the library. This is the current stable release branch 2.x of Botan.\r\n\r\nSecurity Fix(es):\r\n\r\nBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.(CVE-2024-50382)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:37.298856304Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-50382","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T17:15:00Z","modified":"2026-10-17T12:56:39.930547606Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"AZL-51678","title":"CVE-2024-50382 affecting package botan2 2.14.0-2","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T17:15:19Z","modified":"2026-04-21T04:33:14.335305Z","updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"AZL-51707","title":"CVE-2024-50382 affecting package botan2 2.14.0-2","description":"Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.","status":"published","published":"2024-10-23T17:15:19Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.675084Z"},{"id":"openSUSE-SU-2024:0343-1","title":"Security update for Botan","description":"This update for Botan fixes the following issues:\n\n- Fixed CVE-2024-50382, CVE-2024-50383 - various compiler-induced side channel in GHASH when certain LLVM/GCC versions are used to compile Botan.\n","status":"published","published":"2024-10-30T13:01:43Z","modified":"2026-02-04T03:03:57.662141Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14429-1","title":"Botan-3.6.0-1.1 on GA media","description":"These are all security issues fixed in the Botan-3.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2026-02-04T03:02:00.456434Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"ROOT-OS-ALPINE-319-CVE-2024-50382","title":"CVE-2024-50382 in botan - Patched by Root","description":"Root has patched CVE-2024-50382 in the botan package for Root:Alpine:3.19. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:28:53Z","modified":"2026-09-29T10:15:42.651465423Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2024-50382","title":"CVE-2024-50382 in botan - Patched by Root","description":"Root has patched CVE-2024-50382 in the botan package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:30:59Z","modified":"2026-09-29T10:15:04.784463147Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"USN-7586-1","title":"botan vulnerabilities","description":"It was discovered that Botan could have compiler dependent operations\ninduced under certain circumstances. An attacker could possibly use this\nissue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383)\n\nBing Shi discovered that Botan did not limit the size of certain inputs\nwhen checking primality and name constraints. An attacker could possibly\nuse this issue to cause a denial of service. (CVE-2024-34702,\nCVE-2024-34703)\n\nIt was discovered that Botan did not correctly handle conflicting name\nconstraints. An attacker could possibly use this issue to bypass\nauthentication. (CVE-2024-39312)","status":"published","published":"2025-06-23T02:10:22Z","modified":"2026-04-27T18:05:02.082909Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}