CVE-2017-14737 Information disclosure in n/a

What is CVE-2017-14737?

CVE-2017-14737 is a medium-severity vulnerability in Debian Debian Linux, published on 26 Sep 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key.

Which versions are affected by CVE-2017-14737?

It affects 2 products.

Products include Botan Project Botan, Debian Debian Linux.

How do I fix CVE-2017-14737?

Upgrade to a fixed version.

Is CVE-2017-14737 being exploited?

There is no known exploitation of CVE-2017-14737 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2021-24115 Information disclosure in n/a Critical 9.8
• CVE-2018-9127 Security feature bypass in n/a Critical 9.8
• CVE-2015-7826 Security feature bypass in n/a Critical 9.8
• CVE-2016-6878 Other in n/a Critical 9.8
• CVE-2016-9132 Integer overflow in n/a Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DLA-1125-1, DLA-2812-1, GHSA-xr8r-2cxg-2rgp, MGASA-2017-0422, SUSE-SU-2017:2855-1, UBUNTU-CVE-2017-14737.