CVE-2018-9860 - CVE House
Back to Database
Status published High CVE-2018-9860

An issue was discovered in Botan 1.11.32 through 2.x before...

Vulnerability Description

An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9860

Credits & Attribution

No credits recorded in the NVD database.

References

More from botan project

View All →
CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP...
Unknown 0
CVE-2021-40529
The ElGamal implementation in Botan through 2.18.1, as used in...
Medium 5.9
CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for...
Critical 9.8
CVE-2018-9127
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard...
Critical 9.8
CVE-2018-20187
A side-channel issue was discovered in Botan before 2.9.0. An...
Medium 5.9

Affected Vendor

botan project

View all reports →

Affected Software

botan
Vulnerable Versions:
1.11.32

Timeline

Official Publish: April 12th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.