CVE-2018-12435

Name: CVE-2018-12435
Creator: NVD / NIST
Published: 2018-06-15T02:29:00.377+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.50%

Last modified Jun 17, 2026

CVE-2018-12435 is a vulnerability of currently unknown severity. Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.. EPSS estimates a 0.50% chance of exploitation in the next 30 days.

Description

Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Metrics

EPSS Probability

0.50%

38.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Botan Project	Botan	>= 2.5.0, <= 2.7.0

References

https://botan.randombit.net/security.htmlThird Party Advisory
https://github.com/randombit/botan/commit/48fc8df51d99f9d8ba251219367b3d629cc848e3Patch, Third Party Advisory
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/Exploit, Third Party Advisory
https://botan.randombit.net/security.htmlThird Party Advisory
https://github.com/randombit/botan/commit/48fc8df51d99f9d8ba251219367b3d629cc848e3Patch, Third Party Advisory
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/Exploit, Third Party Advisory

Timeline

Published: Jun 15, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-12435?

How severe is CVE-2018-12435?

Severity scoring for CVE-2018-12435 is pending analysis. The EPSS model estimates a 0.50% probability of exploitation in the next 30 days.

How do I fix CVE-2018-12435?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-12435?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST