There are 2 open security issues in buster.
1 important issue:
- CVE-2021-40529:
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
1 issue left for the package maintainer to handle:
- CVE-2021-24115:
(needs triaging)
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex).
You can find information about how to handle this issue in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/b/botan.png){kind=link}