An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-04-12T05:00:00

Updated: 2024-08-05T07:24:56.311Z

Reserved: 2018-04-09T00:00:00

Link: CVE-2018-9860

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-04-12T05:29:00.220

Modified: 2024-11-21T04:15:49.560

Link: CVE-2018-9860

cve-icon Redhat

No data.