PT-2023-10644 · Botan · Botan

Solar Designer · Published 2023-11-03 · Updated 2023-11-13 · CVE-2017-7252

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Botan versions prior to 2.1.0

Description The issue concerns bcrypt password hashing in Botan, where passwords with a length between 57 and 72 characters are not handled correctly. This incorrect handling makes it easier for attackers to determine the cleartext password.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of passwords with lengths between 57 and 72 characters until the update is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-7252

Affected Products

Botan

References · 5

• https://osv.dev/vulnerability/CVE-2017-7252 · Vendor Advisory
• https://botan.randombit.net/security.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7252 · Security Note
• https://t.me/cibsecurity/73500 · Telegram Post
• https://bugzilla.suse.com/show_bug.cgi?id=1034591 · Note