CVE-2021-40529

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

• CWE-327

• https://eprint.iacr.org/2021/923Technical Description, Third Party Advisory
• https://github.com/randombit/botan/pull/2790Patch, Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72NB4OLD3VHJC3YF3PEP2HKF6BYURPAO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPHGYWNJQKWLTUWBNSFB4F66MQDIL3IB/
• https://security.gentoo.org/glsa/202208-14Third Party Advisory
• https://eprint.iacr.org/2021/923Technical Description, Third Party Advisory
• https://github.com/randombit/botan/pull/2790Patch, Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72NB4OLD3VHJC3YF3PEP2HKF6BYURPAO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPHGYWNJQKWLTUWBNSFB4F66MQDIL3IB/
• https://security.gentoo.org/glsa/202208-14Third Party Advisory

Published

Sep 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40523In Contiki 3.0, Telnet option negotiation is mishandled. Dur…7.5
• CVE-2021-40524In Pure-FTPd before 1.0.50, an incorrect max_filesize quota …7.5
• CVE-2021-40525Apache James ManagedSieve implementation alongside with the …9.1
• CVE-2021-40526Incorrect calculation of buffer size vulnerability in Peleto…5.3
• CVE-2021-40527Exposure of senstive information to an unauthorised actor in…7.5
• CVE-2021-40528The ElGamal implementation in Libgcrypt before 1.9.4 allows …5.9
• CVE-2021-4053Use after free in UI in Google Chrome on Linux prior to 96.0…8.8
• CVE-2021-40530The ElGamal implementation in Crypto++ through 8.5 allows pl…5.9
• CVE-2021-40531Sketch before 75 allows library feeds to be used to bypass f…9.8
• CVE-2021-40532Telegram Web K Alpha before 0.7.2 mishandles the characters …9.8
• CVE-2021-40537Server Side Request Forgery (SSRF) vulnerability exists in o…2.7
• CVE-2021-40539Zoho ManageEngine ADSelfService Plus version 6113 and prior …9.8