PT-2017-15546 · Randombit+1 · Botan+1

Aleksandar Nikolic · Published 2017-05-09 · Updated 2024-06-15 · CVE-2017-2801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Randombit Botan cryptographic library version 2.0.1

Description A programming error in the Randombit Botan cryptographic library could lead to certificate verification issues. This issue arises from the way the library implements x500 string comparisons, potentially allowing abuse. To trigger this issue, a specially crafted X509 certificate would need to be delivered to the client or server application.

Recommendations For Randombit Botan cryptographic library version 2.0.1, consider updating to a newer version that addresses this issue, as the current version may lead to certificate verification problems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-2801

DLA-915-1

DSA-3939-1

MGASA-2017-0321

MGASA-2017-0327

OPENSUSE-SU-2024:10594-1

SUSE-SU-2017:1222-1

Affected Products

Botan

Suse

References · 49

• 🔥 http://talosintelligence.com/vulnerability_reports/TALOS-2017-0294 · Exploit
• https://osv.dev/vulnerability/MGASA-2017-0327 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10594-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2801 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3939-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3939-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2801 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0321 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/botan1.10 · Vendor Advisory
• https://debian.org/security/2017/dsa-3939 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0321.html · Security Note
• http://debian.org/security/2017/dsa-3939 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1222-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2801 · Security Note
• https://ubuntu.com/security/CVE-2017-2801 · Vendor Advisory