CVE-2024-39312
published 2024-07-08CVE-2024-39312: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.27%
19.1th percentile
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| botan_project | botan | < 2.19.5 | 2.19.5 |
| botan_project | botan | >= 0 < 2.19.3+dfsg-1+deb12u1 | 2.19.3+dfsg-1+deb12u1 |
| botan_project | botan | >= 0 < 2.19.5+dfsg-1 | 2.19.5+dfsg-1 |
| botan_project | botan | >= 0 < 2.19.1+dfsg-2ubuntu1+esm1 | 2.19.1+dfsg-2ubuntu1+esm1 |
| botan_project | botan | >= 0 < 2.19.3+dfsg-1ubuntu2+esm1 | 2.19.3+dfsg-1ubuntu2+esm1 |
| botan_project | botan | >= 3.0.0 < 3.5.0 | 3.5.0 |
| debian | botan | < botan 2.19.3+dfsg-1+deb12u1 (bookworm) | botan 2.19.3+dfsg-1+deb12u1 (bookworm) |
| randombit | botan | < 2.19.5 | 2.19.5 |
| randombit | botan | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
botan vulnerabilities
osv·2025-06-23·CVSS 5.3
CVE-2024-50382 [MEDIUM] botan vulnerabilities
botan vulnerabilities
It was discovered that Botan could have compiler dependent operations
induced under certain circumstances. An attacker could possibly use this
issue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383)
Bing Shi discovered that Botan did not limit the size of certain inputs
when checking primality and name constraints. An attacker could possibly
use this issue to cause a denial of service. (CVE-2024-34702,
CVE-2024-34703)
It was discovered that Botan did not correctly handle conflicting name
constraints. An attacker could possibly use this issue to bypass
authentication. (CVE-2024-39312)
OSV
CVE-2024-39312: Botan is a C++ cryptography library
osv·2024-07-08·CVSS 5.3
CVE-2024-39312 [MEDIUM] CVE-2024-39312: Botan is a C++ cryptography library
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.
Ubuntu
Botan vulnerabilities
vendor_ubuntu·2025-06-23·CVSS 5.3
CVE-2024-50382 [MEDIUM] Botan vulnerabilities
Title: Botan vulnerabilities
Summary: Several security issues were fixed in Botan.
It was discovered that Botan could have compiler dependent operations
induced under certain circumstances. An attacker could possibly use this
issue to cause undefined behavior. (CVE-2024-50382, CVE-2024-50383)
Bing Shi discovered that Botan did not limit the size of certain inputs
when checking primality and name constraints. An attacker could possibly
use this issue to cause a denial of service. (CVE-2024-34702,
CVE-2024-34703)
It was discovered that Botan did not correctly handle conflicting name
constraints. An attacker could possibly use this issue to bypass
authentication. (CVE-2024-39312)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-39312: botan - Botan is a C++ cryptography library. X.509 certificates can identify elliptic cu...
vendor_debian·2024·CVSS 5.3
CVE-2024-39312 [MEDIUM] CVE-2024-39312: botan - Botan is a C++ cryptography library. X.509 certificates can identify elliptic cu...
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.
Scope: local
bookworm: resolved (fixed in 2.19.3+dfsg-1+deb12u1)
bullseye: open
trixie: resolved (fixed in 2.19.5+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-08
Published