Stay Secure with the Latest Linux Advisories

security advisorysecurity patchperformance issue

Mageia 9: MGASA-2024-0297 Critical ECDSA Security Patch

An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known . MGASA-2024-0297 - Updated botan2 packages fix security vulnerability Publication date: 13 Sep 2024 URL: https://advisories.mageia.org/MGASA-2024-0297.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-34703 An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan. References: - https://bugs.mageia.org/show_bug.cgi?id=33429 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/QNLPSUOQTRVMV6WYZLISDVNWVFZEBQR5/ - https://www.cve.org/CVERecord?id=CVE-2024-34703 SRPMS: - 9/core/botan2-2.19.5-1.mga9 . The latest botan2 updates tackle a critical ECDSA vulnerability in Mageia 9, launched on September 13, 2024, enhancing overall performance.. ECDSA, Mageia, Botan2, Security Patch, Certification. . Severity: Critical. LinuxSecurity.com Team

Sep 13, 2024 •Critical Mageia