CVE-2021-24115
📋 TL;DR
This vulnerability in Botan cryptographic library allows attackers to perform timing attacks against base32, base58, base64, and hex encoding/decoding operations. The lack of constant-time computations enables side-channel attacks that could leak sensitive information. Any application using Botan for these encoding operations is affected.
💻 Affected Systems
- Botan cryptographic library
📦 What is this software?
Botan by Botan Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of cryptographic secrets, authentication tokens, or sensitive data through timing side-channel attacks, potentially leading to full system compromise.
Likely Case
Information disclosure of encoded sensitive data such as API keys, tokens, or encrypted payloads through timing analysis.
If Mitigated
Limited impact if proper network segmentation and access controls prevent attackers from performing precise timing measurements.
🎯 Exploit Status
Exploitation requires precise timing measurements and knowledge of the encoding operations being used. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.17.3
Vendor Advisory: https://botan.randombit.net/news.html
Restart Required: Yes
Instructions:
1. Update Botan to version 2.17.3 or later. 2. Recompile any applications using Botan. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Disable vulnerable encoding functions
allAvoid using Botan's base32, base58, base64, and hex encoding/decoding functions until patched
🧯 If You Can't Patch
- Implement network-level protections to prevent precise timing measurements
- Use alternative encoding libraries for sensitive operations
🔍 How to Verify
Check if Vulnerable:
Check Botan version with 'botan version' or examine library version in application dependenciesCheck Version:
botan versionVerify Fix Applied:
Confirm Botan version is 2.17.3 or later and verify applications are using the updated library📡 Detection & Monitoring
Log Indicators:
- Unusual timing patterns in encoding/decoding operations
- Multiple failed timing measurement attempts
Network Indicators:
- Repeated requests with varying payloads to encoding endpoints
- Abnormal request timing patterns
SIEM Query:
source="application_logs" AND (message="*encoding*" OR message="*decoding*") AND duration_ms > threshold