LiveActive security incident?Get immediate response
CVE Record

CVE-2018-20187: A side-channel issue was discovered in Botan before 2.9.0.

A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Botan before 2.9.0 could leak limited information during ECC key generation through timing behavior. The issue is narrow: it affects key generation only, not ECDSA signing or ECDH agreement. Business urgency depends on whether older Botan versions generate ECC keys where an attacker can precisely observe timing.

Executive priority

Treat as a targeted cryptographic exposure, not a broad emergency. Prioritize internet-facing, multi-tenant, or remote key-generation services using Botan before 2.9.0, then handle embedded or internal uses through normal dependency update cycles.

Technical view

The public-point derivation during ECC key generation used an unblinded Montgomery ladder whose loop count depended on the secret scalar bitlength. Precise timing may reveal information about high bits of the secret key. The supplied CVE record states Botan before 2.9.0 is affected and limits scope to key generation.

Likely exposure

Exposure is likely limited to applications, appliances, or services using Botan before 2.9.0 for ECC key generation in attacker-observable timing contexts. Systems only using affected Botan code for ECDSA signatures or ECDH key agreement are not described as affected by this CVE.

Exploitation context

The supplied sources do not show active exploitation or KEV listing. Practical exploitation requires precise timing of ECC key generation, making this more constrained than a remote unauthenticated compromise, but still relevant where long-lived cryptographic keys are generated in observable environments.

Researcher notes

Key questions are version confirmation, whether ECC key generation is reachable, and whether timing can be measured precisely enough. The CVE record provides no CVSS, no affected CPEs, and no evidence of active exploitation in the supplied bundle.

Mitigation direction

  • Identify Botan versions in direct and transitive dependencies.
  • Upgrade affected Botan deployments to 2.9.0 or later where applicable.
  • Check Botan security guidance for any deployment-specific recommendations.
  • Regenerate exposed ECC keys if credible timing observation occurred.

Validation and detection

  • Inventory software and firmware using Botan before 2.9.0.
  • Confirm whether ECC key generation happens in attacker-observable contexts.
  • Verify ECDSA signing and ECDH-only use cases are not over-scoped.
  • Review logs or architecture for remote key-generation workflows.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-20187 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.