PT-2023-10644 · Botan · Botan

Solar Designer · Publicado 2023-11-03 · Atualizado 2023-11-13 · CVE-2017-7252

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 2.1.0

Description The issue concerns bcrypt password hashing in Botan, where passwords with a length between 57 and 72 characters are not handled correctly. This incorrect handling makes it easier for attackers to determine the cleartext password.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of passwords with lengths between 57 and 72 characters until the update is applied.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-7252

Produtos afetados

Botan

Referências · 5

• https://t.me/cibsecurity/73500 · Publicação no Telegram
• https://bugzilla.suse.com/show_bug.cgi?id=1034591 · Nota
• https://osv.dev/vulnerability/CVE-2017-7252 · Aviso do Fabricante
• https://botan.randombit.net/security.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7252 · Nota de Segurança