Medium severity5.5NVD Advisory· Published Sep 26, 2017· Updated May 13, 2026
CVE-2017-14737
CVE-2017-14737
Description
A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key.
Affected products
37cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*+ 35 more
- cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:*range: <=1.10.16
- cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.10:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.11:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.12:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.14:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.15:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.16:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.17:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.18:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.19:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.20:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.21:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.22:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.23:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.24:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.25:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.26:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.27:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.28:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.33:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.34:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.7:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.8:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:1.11.9:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:botan_project:botan:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/randombit/botan/issues/1222nvdIssue TrackingThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/11/msg00006.htmlnvdMailing ListThird Party Advisory
- www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuainvdThird Party Advisory
News mentions
0No linked articles in our index yet.