CVE-2024-34702

published 2024-07-08

CVE-2024-34702: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the…

Priority P4 26 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I N A L

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
botan_project	botan	>= 0 < 2.19.3+dfsg-1+deb12u1	2.19.3+dfsg-1+deb12u1
botan_project	botan	>= 0 < 2.19.5+dfsg-1	2.19.5+dfsg-1
botan_project	botan	>= 0 < 2.19.1+dfsg-2ubuntu1+esm1	2.19.1+dfsg-2ubuntu1+esm1
botan_project	botan	>= 0 < 2.19.3+dfsg-1ubuntu2+esm1	2.19.3+dfsg-1ubuntu2+esm1
debian	botan	< botan 2.19.3+dfsg-1+deb12u1 (bookworm)	botan 2.19.3+dfsg-1+deb12u1 (bookworm)
randombit	botan	< 2.19.5	2.19.5
randombit	botan	—	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

osv 5.3 MEDIUM

vendor_debian 5.3 MEDIUM

vendor_ubuntu 5.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-405