Debian Botan3 vulnerabilities

CVE-2026-32877 [HIGH] CVE-2026-32877: botan - Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0... Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison. An invalid ciphertext can cause a heap over-read of up to 31 bytes, resulting in a crash or potentially other undefined b

CVE-2026-34582 [HIGH] CVE-2026-34582: botan - Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implem... Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message an

CVE-2026-32884 [MEDIUM] CVE-2026-32884: botan - Botan is a C++ cryptography library. Prior to version 3.11.0, during processing ... Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not requ

CVE-2026-32883 [MEDIUM] CVE-2026-32883: botan - Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0... Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0. Scope: local bookworm: resolved bullseye: resolved trixie: resolved

CVE-2026-34580 [CRITICAL] CVE-2026-34580: botan3 - Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::... Botan is a C++ cryptography library. In 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it would return true if any certificate in the store had a DN (and subject key identifier, if set) matching that of the argument. It did not check that the cert it found and the cert it was passed were actually the same certificate. In 3.11.0 a