Alerts This Week
Warning Icon 1 1,153
Alerts This Week
Warning Icon 1 1,153

Mageia 9: Notice on Botan2 CVE-2024-50384 Denial of Service MGASA-2025-0296

mageia
Calendar Grey November 15, 2025
Dist Mageia Esm H88
Updated botan2 packages for Mageia fix critical CVE-2024-50383 vulnerability affecting GCC users.
MGASA-2025-0295 - Updated botan2 packages fix security vulnerabilitiy

Summary

Description: Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386 (only 32-bit processors can be affected). (CVE-2024-50383)

References

- https://bugs.mageia.org/show_bug.cgi?id=34391

- https://ubuntu.com/security/notices/USN-7586-1

- https://www.cve.org/CVERecord?id=CVE-2024-50383

Topics%20covered

Topics Covered

security advisory critical DoS CVE Mageia botan2

Resolution

SRPMS

- 9/core/botan2-2.19.5-1.1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 15 Nov 2025
URL: https://advisories.mageia.org/MGASA-2025-0295.html
Type: security
CVE: CVE-2024-50383

Topics%20covered

Topics Covered

security advisory critical DoS CVE Mageia botan2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here