CVE catalog

CVE-2021-40529

botan: CVE-2021-40529

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.53% · Oct 27, 2026

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbotantrixie2.19.5+dfsg-4fixed
Debianbotanbookworm2.19.3+dfsg-1+deb12u1fixed
Alpinebotan3.142.17.3-r3fixed
Alpinebotan3.152.18.1-r3fixed
Alpinebotan3.162.18.1-r3fixed
Alpinebotan3.172.18.1-r3fixed
Alpinebotan3.182.18.1-r3fixed
Alpinebotan3.192.18.1-r3fixed
Alpinebotan3.202.18.1-r3fixed
Alpinebotan3.212.18.1-r3fixed
Ubuntubotan1.10pro1.10.5-1vulnerable
Ubuntubotan1.10pro1.10.5-1ubuntu1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1+esm1vulnerable
Ubuntubotan1.1016.041.10.10-6vulnerable
Ubuntubotan1.1016.041.10.12-1vulnerable
Ubuntubotan18.042.4.0-3vulnerable
Ubuntubotan18.042.4.0-4vulnerable
Ubuntubotan18.042.4.0-5ubuntu1vulnerable
Ubuntubotan1.1018.041.10.16-1vulnerable
Ubuntubotan1.1018.041.10.17-0.1vulnerable
Ubuntubotan20.042.9.0-2vulnerable
Ubuntubotan20.042.9.0-2build1vulnerable
Ubuntubotan20.042.12.1-2vulnerable
Ubuntubotan20.042.12.1-2build1vulnerable
Ubuntubotanpro2.17.3+dfsg-3vulnerable
Ubuntubotanpro2.19.1+dfsg-2ubuntu1vulnerable
Ubuntubotanpro2.19.1+dfsg-2ubuntu1+esm1vulnerable
OpensuseBotantumbleweed2.18.2-1.1fixed
OpensuseMozillaThunderbirdtumbleweed91.4.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbotansourcetrixie2.18.1+dfsg-3not yet assignedNot reported[993840]
Debianbotansourcebookworm2.18.1+dfsg-3not yet assignedNot reported[993840]
Alpinebotanapk3.142.17.3-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.152.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.162.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.172.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.182.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.192.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.202.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
Alpinebotanapk3.212.18.1-r3Not reportedALPINE-CVE-2021-40529Not reported
OpensuseBotanrpmtumbleweed2.18.2-1.1Not reportedOPENSUSE-SU-2024:11661-1Not reported
OpensuseMozillaThunderbirdrpmtumbleweed91.4.0-1.1Not reportedOPENSUSE-SU-2024:11670-1Not reported

[Debian bug #993840]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [botan]Unknown
    Details (2)

    • 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

    • 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

  • [libbotan-2-19]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

    • 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

  • [libbotan-2-dev]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

    • 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

  • [libbotan-2-doc]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.3+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

    • 2.19.3+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

  • [python3-botan]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

    • 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · bookworm; dsa · botan · debian · 12

[Debian 13 (Trixie)]

  • [botan]Unknown

    Source package: [botan3]

    Details (4)

    • 3.7.1+dfsg-2 · amd64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 3.7.1+dfsg-2 · arm64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 3.12.0+dfsg-2~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 3.12.0+dfsg-2~deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

  • [libbotan-2-19]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.5+dfsg-4 · amd64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 2.19.5+dfsg-4 · arm64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

  • [libbotan-2-dev]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.5+dfsg-4 · amd64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 2.19.5+dfsg-4 · arm64 · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

  • [libbotan-2-doc]Unknown

    Source package: [botan]

    Details (2)

    • 2.19.5+dfsg-4 · all · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

    • 2.19.5+dfsg-4 · all · trixie

      Fixed · Fixed: 2.18.1+dfsg-3

      dsa · botan · debian · 13

[openSUSE Tumbleweed]

  • [Botan]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 2.18.2-1.1

      dsa · Botan · opensuse · tumbleweed

  • [Botan-doc]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · noarch · tumbleweed

      Unknown · Fixed: 2.18.2-1.1

      Version impact unknown

      dsa · Botan · opensuse · tumbleweed

  • [libbotan-3-11]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.2-1.1

      Version impact unknown

      dsa · Botan · opensuse · tumbleweed

  • [libbotan-devel]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.2-1.1

      Version impact unknown

      dsa · Botan · opensuse · tumbleweed

  • [MozillaThunderbird]Unknown

    Source package: [MozillaThunderbird]

    Details (1)

    • 140.14.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 91.4.0-1.1

      dsa · MozillaThunderbird · opensuse · tumbleweed

  • [MozillaThunderbird-openpgp-librnp]Unknown

    Source package: [MozillaThunderbird]

    Details (1)

    • 140.14.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 91.4.0-1.1

      Version impact unknown

      dsa · MozillaThunderbird · opensuse · tumbleweed

  • [MozillaThunderbird-translations-common]Unknown

    Source package: [MozillaThunderbird]

    Details (1)

    • 140.14.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 91.4.0-1.1

      Version impact unknown

      dsa · MozillaThunderbird · opensuse · tumbleweed

  • [MozillaThunderbird-translations-other]Unknown

    Source package: [MozillaThunderbird]

    Details (1)

    • 140.14.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 91.4.0-1.1

      Version impact unknown

      dsa · MozillaThunderbird · opensuse · tumbleweed

  • [python3-botan]Unknown

    Source package: [Botan]

    Details (1)

    • 3.11.1-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 2.18.2-1.1

      Version impact unknown

      dsa · Botan · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]