{"id":"UBUNTU-CVE-2021-43398","details":"** DISPUTED ** Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value.","modified":"2021-11-04T21:15:00Z","published":"2021-11-04T21:15:00Z","withdrawn":"2025-06-23T15:54:07Z","references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-43398"},{"type":"REPORT","url":"https://github.com/weidai11/cryptopp/issues/1080"},{"type":"REPORT","url":"https://cryptopp.com"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-43398"}],"affected":[{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.1-6","5.6.1-6+deb8u1build0.14.04.1","5.6.1-6+deb8u3build0.14.04.1","5.6.1-6+deb8u3ubuntu0.1~esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}},{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.1-8","5.6.1-9","5.6.1-9ubuntu0.1","5.6.1-9ubuntu0.1+esm1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}},{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.4-8"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}},{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.4-9","5.6.4-9build1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}},{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-1","8.6.0-2ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}},{"package":{"name":"libcrypto++","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libcrypto%2B%2B"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.8.0-1","8.9.0-1","8.9.0-1.1","8.9.0-1.1build1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43398.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}