CVE-2024-50383: botan_project botan Observable Discrepancy
Vulnerability summary
CVE-2024-50383 is a medium (CVSS 5.9) Observable Discrepancy vulnerability in botan_project botan. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 23-10-2024PublishedVulnerability first disclosed.
- 24-10-2024Last modifiedVulnerability information updated.
Description
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (arxiv.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- botanAll versions (No fix recorded) | < 2.19.1+dfsg-2ubuntu1+esm1 | < 2.19.3+dfsg-1ubuntu2+esm1
- oscarAll versions (No fix recorded)
Botan_project1 product
- botan< 3.6.0
Debian1 product
- botan< 2.19.3+dfsg-1+deb12u1 | < 2.19.5+dfsg-3
Mageia1 product
- botan2< 2.19.5-1.1.mga9
4 vendors · 5 products
