Vulnerability CVE-2017-14737

Vulnerability Name:

CVE-2017-14737 (CCN-132627)

Assigned:

2017-09-25

Published:

2017-09-25

Updated:

2021-12-15

Summary:

A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key.

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2017-14737

Source: CCN
Type: IBM Security Bulletin 2012829 (PureData System for Analytics)
A vulnerability in Open Source Botan affects IBM Netezza Platform Software clients

Source: CCN
Type: IBM Security Bulletin 2013399 (PureData System for Analytics)
A vulnerability in Open Source Botan affects IBM Netezza SQL Extensions

Source: XF
Type: UNKNOWN
botan-cve201714737-info-disc(132627)

Source: CCN
Type: Botan GIT Repository
Investigate RSA side channel from Usenix Security #1222

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://github.com/randombit/botan/issues/1222

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20211108 [SECURITY] [DLA 2812-1] botan1.10 security update

Source: MISC
Type: Third Party Advisory
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-14737

Vulnerable Configuration:

Configuration 1:

cpe:/a:botan_project:botan:1.11.6:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.7:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.8:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.9:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.23:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.24:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.25:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.26:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:*:*:*:*:*:*:*:* (Version <= 1.10.16)

OR cpe:/a:botan_project:botan:1.11.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.1:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.15:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.16:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.17:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.18:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.3:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.5:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.10:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.12:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.14:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.19:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.21:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.28:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.34:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.2:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.4:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.11:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.13:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.20:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.22:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.27:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.11.33:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:botan_project:botan:1.11.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.10.16:*:*:*:*:*:*:*

OR cpe:/a:botan_project:botan:1.10.13:*:*:*:*:*:*:*

AND

cpe:/a:ibm:puredata_system:1.0.0:*:*:*:analytics:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201714737	V	CVE-2017-14737	2022-09-02
oval:org.opensuse.security:def:111882	P	Botan-2.18.1-1.3 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:10440	P	Security update for MozillaFirefox (Important) (in QA)	2022-01-14
oval:org.opensuse.security:def:10425	P	Security update for java-1_8_0-ibm (Important) (in QA)	2022-01-04
oval:org.opensuse.security:def:10378	P	Security update for MozillaFirefox (Important)	2021-12-10
oval:org.opensuse.security:def:10158	P	Security update for grilo (Important)	2021-10-06
oval:org.opensuse.security:def:105462	P	Botan-2.18.1-1.3 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:10332	P	Security update for spectre-meltdown-checker (Moderate)	2021-08-27
oval:org.opensuse.security:def:10322	P	Security update for openexr (Important)	2021-08-20
oval:org.opensuse.security:def:10139	P	Security update for djvulibre (Important)	2021-08-20
oval:org.opensuse.security:def:10310	P	Security update for qemu (Important)	2021-08-02
oval:org.opensuse.security:def:10124	P	Security update for MozillaFirefox (Important)	2021-07-27
oval:org.opensuse.security:def:10309	P	Security update for MozillaFirefox (Important)	2021-07-27
oval:org.opensuse.security:def:10302	P	Security update for dbus-1 (Important)	2021-07-12
oval:org.opensuse.security:def:17022	P	libqt4-sql-mysql-32bit-4.8.6-2.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17030	P	libxerces-c-3_1-3.1.1-1.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11261	P	MozillaFirefox-31.1.0esr-1.20 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17064	P	libgadu3-1.11.4-1.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11283	P	cvs-1.12.12-181.63 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17149	P	telepathy-idle-0.2.0-1.62 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17206	P	libvdpau1-32bit-1.1.1-6.73 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:124501	P	libbotan-1_10-0-1.10.9-4.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17237	P	gnome-online-accounts-3.20.5-9.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17273	P	libpolkit0-32bit-0.113-5.12.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16495	P	libbotan-1_10-0-1.10.9-4.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:10258	P	Security update for the Linux Kernel (Important)	2021-05-18
oval:org.opensuse.security:def:10077	P	Security update for the Linux Kernel (Important)	2021-05-12
oval:org.opensuse.security:def:10233	P	Security update for tomcat (Important)	2021-04-01
oval:org.opensuse.security:def:10300	P	Security update for nodejs8 (Moderate)	2021-01-26
oval:org.opensuse.security:def:10031	P	Security update for openssl-1_0_0 (Important)	2020-12-11
oval:org.opensuse.security:def:17383	P	python3-urllib3-1.22-3.17.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16797	P	libbotan-1_10-0-1.10.9-4.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:17312	P	doxygen-1.8.6-3.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3961	P	libbotan-1_10-0-1.10.9-4.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:17320	P	gimp-2.8.18-9.3.26 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:17354	P	libofx-0.9.9-3.7.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:10601	P	sudo-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17527	P	Security update for xorg-x11-server (Moderate)	2020-12-01
oval:org.opensuse.security:def:18460	P	Security update for Botan (Moderate)	2020-12-01
oval:org.opensuse.security:def:10960	P	libXfixes-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10610	P	xfig on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17415	P	Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP3) (Important)	2020-12-01
oval:org.opensuse.security:def:17563	P	Security update for gd (Low)	2020-12-01
oval:org.opensuse.security:def:10982	P	libbotan-1_10-0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10623	P	alsa-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17472	P	Security update for java-1_7_0-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:17673	P	Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:17484	P	Security update for java-1_8_0-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:17705	P	Security update for libotr (Moderate)	2020-12-01
oval:org.opensuse.security:def:17506	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:17762	P	Security update for gdk-pixbuf (Moderate)	2020-12-01
oval:org.opensuse.security:def:10001	P	sysvinit-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10459	P	krb5-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:18144	P	Security update for evince (Important)	2020-12-01
oval:org.opensuse.security:def:17774	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:10009	P	vino on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10534	P	libpulse-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:18170	P	Security update for Botan (Moderate)	2020-12-01
oval:org.opensuse.security:def:17439	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:17796	P	Security update for libstorage (Moderate)	2020-12-01
oval:org.opensuse.security:def:10559	P	libvirt-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17496	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:18434	P	Security update for postgresql96 (Important)	2020-12-01
oval:com.ubuntu.bionic:def:2017147370000000	V	CVE-2017-14737 on Ubuntu 18.04 LTS (bionic) - medium.	2017-09-26
oval:com.ubuntu.xenial:def:2017147370000000	V	CVE-2017-14737 on Ubuntu 16.04 LTS (xenial) - medium.	2017-09-26
oval:com.ubuntu.artful:def:201714737000	V	CVE-2017-14737 on Ubuntu 17.10 (artful) - medium.	2017-09-25
oval:com.ubuntu.xenial:def:201714737000	V	CVE-2017-14737 on Ubuntu 16.04 LTS (xenial) - medium.	2017-09-25
oval:com.ubuntu.bionic:def:201714737000	V	CVE-2017-14737 on Ubuntu 18.04 LTS (bionic) - medium.	2017-09-25
oval:com.ubuntu.cosmic:def:201714737000	V	CVE-2017-14737 on Ubuntu 18.10 (cosmic) - medium.	2017-09-25
oval:com.ubuntu.cosmic:def:2017147370000000	V	CVE-2017-14737 on Ubuntu 18.10 (cosmic) - medium.	2017-09-25
oval:com.ubuntu.trusty:def:201714737000	V	CVE-2017-14737 on Ubuntu 14.04 LTS (trusty) - medium.	2017-09-25

BACK