CVE-2021-40529 — Vulnetix

CVE-2021-40529 PUBLISHED CVSS 5.900000095367432 MEDIUM

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

EPSS 0.29% · 52.5th percentile

Risk Scores

CVSS 3.1

5.900000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.29%

52.5th percentile

Affected Products

Vendor	Product	Versions
fedoraproject	fedora	34, 35
n/a	n/a	n/a
botan_project	botan	0
mozilla	thunderbird	0

Exploit Intelligence

https://eprint.iacr.org/2021/923 (circl)
https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 (circl)
https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 (circl)
https://github.com/randombit/botan/pull/2790 (circl)
FEDORA-2021-14b0d97496 (circl)
FEDORA-2021-8d51cac49f (circl)
GLSA-202208-14 (circl)

Timeline

Sep 6, 2021 CVE Published
Sep 7, 2021 EPSS Score
Nov 4, 2021 EPSS Score
Jan 1, 2022 EPSS Score
Jan 6, 2022 EPSS Score
Feb 27, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 26, 2022 EPSS Score
Jun 23, 2022 EPSS Score
Aug 21, 2022 EPSS Score
Oct 17, 2022 EPSS Score
Dec 14, 2022 EPSS Score

References

Open in Interactive Console →