ASA-201710-17 generated external raw

[ASA-201710-17] botan: information disclosure
Arch Linux Security Advisory ASA-201710-17 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-14737 Package : botan Type : information disclosure Remote : No Link : Summary ======= The package botan before version 2.3.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.3.0-1. # pacman -Syu "botan>=2.3.0-1" The problem has been fixed upstream in version 2.3.0. Workaround ========== None. Description =========== A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key. Impact ====== A local attacker is able to use a cache-based side channel attack to recover information about RSA secret keys. References ==========