Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 9: MGASA-2024-0297 Critical ECDSA Security Patch

mageia
Calendar Grey September 13, 2024
Dist Mageia Esm H88
The latest botan2 updates tackle a critical ECDSA vulnerability in Mageia 9, launched on September 13, 2024, enhancing overall performance.
An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large

Summary

An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

References

- https://bugs.mageia.org/show_bug.cgi?id=33429

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNLPSUOQTRVMV6WYZLISDVNWVFZEBQR5/

- https://www.cve.org/CVERecord?id=CVE-2024-34703

Topics%20covered

Topics Covered

security advisory security patch performance issue botan2 ecc certification coding update md5

Resolution

SRPMS

- 9/core/botan2-2.19.5-1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 13 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0297.html
Type: security
CVE: CVE-2024-34703

Topics%20covered

Topics Covered

security advisory security patch performance issue botan2 ecc certification coding update md5

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here