Lucene search

K
mageiaGentoo FoundationMGASA-2024-0297
HistorySep 13, 2024 - 8:15 p.m.

Updated botan2 packages fix security vulnerability

2024-09-1320:15:41
Gentoo Foundation
advisories.mageia.org
1
security vulnerability fix
botan2
ecdsa x.509 certificate
explicit encoding
elliptic curve parameters
deprecated

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.

OSVersionArchitecturePackageVersionFilename
Mageia9noarchbotan2< 2.19.5-1botan2-2.19.5-1.mga9

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low