Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34685 State: PUBLISHED Published: 2024-07-09T03:53:38.517Z Last Updated: 2024-08-02T02:59:21.683Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Knowledge Management XMLEditor Problem Types: CWE-79 Description: Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
but it has a low impact on its confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3468681
CVE ID: CVE-2024-34686 State: PUBLISHED Published: 2024-06-11T02:11:49.630Z Last Updated: 2024-08-02T02:59:22.207Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP CRM WebClient UI Problem Types: CWE-79 Description: Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
effect on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3465129 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-34687 State: PUBLISHED Published: 2024-05-14T03:56:24.324Z Last Updated: 2024-08-02T02:59:22.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver Application server for ABAP and ABAP Platform Problem Types: CWE-79 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hi
, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3448445 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-34688 State: PUBLISHED Published: 2024-06-11T02:02:21.587Z Last Updated: 2024-08-02T02:59:22.017Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP_SE Products: SAP NetWeaver AS Java Problem Types: CWE-400 Description: Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/no
ication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3460407 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-34689 State: PUBLISHED Published: 2024-07-09T04:18:21.258Z Last Updated: 2024-08-02T02:59:22.630Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Business Workflow (WebFlow Services) Problem Types: CWE-918 Description: WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://u
of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3458789
CVE ID: CVE-2024-34690 State: PUBLISHED Published: 2024-06-11T02:17:13.787Z Last Updated: 2024-08-02T02:59:21.880Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Student Life Cycle Management Problem Types: CWE-862 Description: SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vul
causing minimal impact on the confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3457265 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-34691 State: PUBLISHED Published: 2024-06-11T02:22:24.435Z Last Updated: 2024-08-02T02:59:22.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP_SE Products: SAP S/4HANA (Manage Incoming Payment Files) Problem Types: CWE-862 Description: Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3466175 -
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3466175 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-34692 State: PUBLISHED Published: 2024-07-09T04:43:05.361Z Last Updated: 2024-08-02T02:59:22.200Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Enable Now Problem Types: CWE-434 Description: Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker can cause limited impact on confidentiality and Integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
y and Integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3476340
CVE ID: CVE-2024-34693 State: PUBLISHED Published: 2024-06-20T08:51:55.329Z Last Updated: 2025-02-21T16:55:58.529Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert the
r the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0 Users are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon - http://www.openwall.com/lists/oss-security/2024/06/20/1
CVE ID: CVE-2024-34694 State: PUBLISHED Published: 2024-06-14T14:31:12.465Z Last Updated: 2024-08-02T02:59:21.774Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: lnbits Products: lnbits Problem Types: CWE-754 Description: LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/
in 0.12.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww
CVE ID: CVE-2024-34695 State: PUBLISHED Published: 2024-05-10T15:57:03.049Z Last Updated: 2024-08-02T02:59:22.237Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: SakuraIsayeki Products: WOWS-Karma Problem Types: CWE-799 Description: WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This
cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SakuraIsayeki/WOWS-Karma/security/advisories/GHSA-v6cc-v976-mj8g - https://github.com/SakuraIsayeki/WOWS-Karma/commit/3210b516fa3551e30fe760c915f7656d9046e69a - https://github.com/SakuraIsayeki/WOWS-Karma/commit/6cb825976f28c68d79172aeda00e955bf5853de2
CVE ID: CVE-2024-34696 State: PUBLISHED Published: 2024-07-01T14:36:05.084Z Last Updated: 2024-08-02T02:59:21.661Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-200 Description: GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as database passwords
modules' status message. These variables/properties can also contain sensitive information, such as database passwords or API keys/tokens. Additionally, many community-developed GeoServer container images `export` other credentials from their start-up scripts as environment variables to the GeoServer (`java`) process. The precise scope of the issue depends on which container image is used and how it is configured. The `about status` API endpoint which powers the Server Status page is only available to administrators.Depending on the operating environment, administrators might have legitimate access to credentials in other ways, but this issue defeats more sophisticated controls (like break-
ght have legitimate access to credentials in other ways, but this issue defeats more sophisticated controls (like break-glass access to secrets or role accounts).By default, GeoServer only allows same-origin authenticated API access. This limits the scope for a third-party attacker to use an administrator’s credentials to gain access to credentials. The researchers who found the vulnerability were unable to determine any other conditions under which the GeoServer REST API may be available more broadly. Users should update container images to use GeoServer 2.24.4 or 2.25.1 to get the bug fix. As a workaround, leave environment variables and Java system properties hidden by default. Those who
o get the bug fix. As a workaround, leave environment variables and Java system properties hidden by default. Those who provide the option to re-enable it should communicate the impact and risks so that users can make an informed choice. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-j59v-vgcr-hxvf
CVE ID: CVE-2024-34697 State: PUBLISHED Published: 2024-05-13T15:45:26.741Z Last Updated: 2024-08-02T02:59:22.332Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: freescout-helpdesk Products: freescout Problem Types: CWE-74 Description: FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code
ty arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections. Additional Ana
ure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-985r-6qfc-hg8m - https://github.com/freescout-helpdesk/freescout/commit/99a4b4b4e153c82e273e549b9efbf6db4a2d8328
CVE ID: CVE-2024-34698 State: PUBLISHED Published: 2024-05-13T15:50:34.498Z Last Updated: 2024-08-02T02:59:21.707Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: freescout-helpdesk Products: freescout Problem Types: CWE-1321 Description: FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source file. The Prototype Pollution arises because the `getQueryParam` Function recursively merges an object containing user-controllable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can
lable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can allow an attacker to inject a property with a key `__proto__`, along with arbitrarily nested properties. The merge operation assigns the nested properties to the `params` object's prototype instead of the target object itself. As a result, the attacker can pollute the prototype with properties containing harmful values, which are then inherited by user-defined objects and subsequently used by the application dangerously. The vulnerability lets an attacker control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker
control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker-controlled property in an unsafe way, this can potentially be chained with other vulnerabilities like DOM-based XSS, Open Redirection, Cookie Manipulation, Link Manipulation, HTML Injection, etc. Version 1.8.139 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-rx6j-4c33-9h3r - https://github.com/freescout-helpdesk/freescout/commit/2614514bc6d6c4ad563202a1c9cae5a97b195cc5
CVE ID: CVE-2024-34699 State: PUBLISHED Published: 2024-05-13T19:01:19.774Z Last Updated: 2024-08-02T02:59:21.655Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GZTimeWalker Products: GZCTF Problem Types: CWE-80, CWE-79 Description: GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in `v0.20.1`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/GZTimeWalker/GZCTF/security/advisories/GHSA-p6rq-5x3x-rmhh - https://github.com/GZTimeWalker/GZCTF/commit/31e77
thub.com/GZTimeWalker/GZCTF/security/advisories/GHSA-p6rq-5x3x-rmhh - https://github.com/GZTimeWalker/GZCTF/commit/31e775b65cddf82a567d68dcdc78c1739b746346
CVE ID: CVE-2024-34701 State: PUBLISHED Published: 2024-05-13T15:54:12.956Z Last Updated: 2024-08-02T02:59:21.802Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: miraheze Products: CreateWiki Problem Types: CWE-863 Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any action
go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there. Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings. As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup
thing similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm.. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/miraheze/CreateWiki/security/advisories/GHSA-89fx-77w7-rc64 - https://github.com/miraheze/CreateWiki/commit/02e0f298f8d35155c39aa74193cb7b867432c5b8 - https://github.com/miraheze/mw-config/commit
b.com/miraheze/CreateWiki/commit/02e0f298f8d35155c39aa74193cb7b867432c5b8 - https://github.com/miraheze/mw-config/commit/1798e53901a202b62edab32f8bcd5c6b9e574191 - https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc - https://issue-tracker.miraheze.org/T12011 - https://issue-tracker.miraheze.org/T12102
CVE ID: CVE-2024-34702 State: PUBLISHED Published: 2024-07-08T16:22:37.770Z Last Updated: 2024-08-02T02:59:22.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: randombit Products: botan Problem Types: CWE-405 Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certif
ed a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j - https://github.com/randombit/botan/pull/4034 - https://github.com/randombit/botan/pull/4045 - https://github.com/randombit/botan/pull/4047 - https://github.com/randombit/botan/pull/4052 - https://gi
tan/pull/4045 - https://github.com/randombit/botan/pull/4047 - https://github.com/randombit/botan/pull/4052 - https://github.com/randombit/botan/pull/4186 - https://github.com/randombit/botan/pull/4187 - https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e - https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac - https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1 - https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf - https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41 - https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91
ommit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41 - https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
CVE ID: CVE-2024-34703 State: PUBLISHED Published: 2024-06-30T20:22:32.910Z Last Updated: 2024-08-02T02:59:21.982Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: randombit Products: botan Problem Types: CWE-405, CWE-770 Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing
The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/randombit/botan/security/advisories/GHSA-w4g2-7m2h-7xj7 - https://github.com/randombit/botan/commit/08c404b23740babee1f6aa51b54e966029aadee4 - https://github.com/randombit/botan/commit/94e9154c143aa5264da625
botan/commit/08c404b23740babee1f6aa51b54e966029aadee4 - https://github.com/randombit/botan/commit/94e9154c143aa5264da6254a6a1be5bc66ee2b5a