Fluid Attacks Database

Description

ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version
debian 11	libcrypto++	=8.4.0-1 \|\| =8.5.0-1 \|\| =8.6.0-1 \|\| =8.6.0-2 \|\| =8.6.0-3 \|\| =8.7.0+git220824-1 \|\| =8.7.0-1 \|\| =8.8.0-1 \|\| =8.8.0-2 \|\| =8.9.0-1 \|\| =8.9.0-1.1 \|\| =8.9.0-1.1~exp1 \|\| =8.9.0-2
debian 12	libcrypto++	=8.7.0+git220824-1 \|\| =8.8.0-1 \|\| =8.8.0-2 \|\| =8.9.0-1 \|\| =8.9.0-1.1 \|\| =8.9.0-1.1~exp1 \|\| =8.9.0-2
debian 13	libcrypto++	=8.9.0-2
debian 14	libcrypto++	=8.9.0-2

Aliases

1. CVE-2023-509812. NVD-2023-509813. OSV-DEBIAN-2023-509814. OSV-2023-509815. SECURITY-TRACKER-CVE-2023-50981

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.