CVE-2018-20187

CVE-2018-20187 describes a side-channel vulnerability in Botan versions prior to 2.9.0, specifically impacting the ECC key generation process. An attacker with precise timing measurement capabilities could potentially infer information about the high bits of a secret key due to an unblinded Montgomery ladder whose iteration count depends on the secret's bitlength. This vulnerability is rated as Medium severity (CVSS 5.9), requiring high attack complexity but allowing for remote compromise of confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.