CVE-2021-40529 Weak cryptography in n/a

What is CVE-2021-40529?

CVE-2021-40529 is a medium-severity vulnerability in Fedoraproject Fedora, published on 6 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Weakness: CWE-327

Which versions are affected by CVE-2021-40529?

It affects 3 products.

Products include Botan Project Botan, Fedoraproject Fedora, Mozilla Thunderbird.

How do I fix CVE-2021-40529?

Upgrade to a fixed version.

Is CVE-2021-40529 being exploited?

There is no known exploitation of CVE-2021-40529 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2021-24115 Information disclosure in n/a Critical 9.8
• CVE-2018-9127 Security feature bypass in n/a Critical 9.8
• CVE-2015-7826 Security feature bypass in n/a Critical 9.8
• CVE-2016-6878 Other in n/a Critical 9.8
• CVE-2016-9132 Integer overflow in n/a Critical 9.8

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-40529, DEBIAN-CVE-2021-40529, GHSA-f9qg-252f-g8cg, MGASA-2021-0563, UBUNTU-CVE-2021-40529, openSUSE-SU-2024:11661-1.