Cryptopp Crypto\+\+
12 CVEs affecting Cryptopp Crypto\+\+. Latest disclosed: 2023-12-18. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50981 | High | 7.5 | 2023-12-18 | ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associ… |
CVE-2023-50980 | High | 7.5 | 2023-12-18 | gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve… |
CVE-2022-48570 | High | 7.5 | 2023-08-22 | Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the… |
CVE-2016-3995 | High | 7.5 | 2017-02-13 | The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimize… |
CVE-2016-9939 | High | 7.5 | 2017-01-30 | Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length f… |
CVE-2016-7544 | High | 7.5 | 2017-01-30 | Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. I… |
CVE-2023-50979 | Medium | 5.9 | 2023-12-18 | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. |
CVE-2021-40530 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangero… |
CVE-2019-14318 | Medium | 5.9 | 2019-07-30 | Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration o… |
CVE-2016-7420 | Medium | 5.9 | 2016-09-16 | Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintende… |
CVE-2021-43398 | Medium | 5.3 | 2021-11-04 | Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key len… |
CVE-2017-9434 | Medium | 5.3 | 2017-06-05 | Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter. |