681 matches found
CVE-2017-2801: Out-of-bounds Read
A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to...
SUSE-SU-2017:1351-1 Security update for Botan
This update for Botan fixes the following issues: - CVE-2015-7827: PKCS 1 v1.5 decoding was not constant time, it could be used to mount a Bleichenbacher million-message attack bsc968030 - CVE-2016-9132: While decoding BER length fields, an integer overflow could occur leading to a...
SUSE-SU-2017:1305-1 Security update for Botan
This update for Botan fixes the following issues: - CVE-2015-7827: PKCS 1 v1.5 decoding was not constant time, it could be used to mount a Bleichenbacher million-message attack bsc968030 - CVE-2016-9132: While decoding BER length fields, an integer overflow could occur leading to a...
SUSE-SU-2017:1222-1 Security update for Botan
This update for Botan to version 1.10.9 fixes the following issues: These security issues were fixed: - CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service application crash via an empty BIT STRING in ASN.1 data bsc968025. - CVE-2015-5727: The BER...
Randombit Botan Identity Bypass Vulnerability
Randombit Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. An identity bypass vulnerability exists in Randombit Botan version 2.0.1. An attacker can exploit this vulnerability to conduct a man-in-the-middle...
Randombit Botan Library X509 Certificate Validation Bypass Vulnerability
Summary A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in...
Botan X509_Certificate::allowed_usage function design vulnerability
Botan is a cryptographic library written in C++11 and distributed under the Simplified BSD license. A design flaw in the Botan X509Certificate::allowedusage function can be exploited by an attacker to cause some impact on calls with more than one KeyUsage set in the enumeration value...
Botan Security Bypass Vulnerability (CNVD-2017-05578)
Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security bypass vulnerability exists in version 1.11.x of Botan prior to 1.11.22, which can be exploited by attackers to obtain sensitive information...
Botan Denial of Service Vulnerability (CNVD-2017-05476)
Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A denial of service vulnerability exists in versions of Botan prior to 1.11.22, which stems from the program failing to properly validate the path of a...
Botan Security Bypass Vulnerability (CNVD-2017-05577)
Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security bypass vulnerability exists in the Curve25519 code in versions of Botan prior to 1.11.31. A remote attacker could exploit this vulnerability to...
Botan Security Bypass Vulnerability
Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security bypass vulnerability exists in Botan version 1.11.x prior to 1.11.22. A remote attacker could exploit this vulnerability to decrypt TLS ciphertext...
CVE-2015-7825
botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service infinite loop and memory consumption via a certificate with a loop in the certificate chain...
CVE-2015-7826
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting .example.com as a match for bar.foo.example.com...
Code injection
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting .example.com as a match for bar.foo.example.com...
CVE-2015-7825
botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service infinite loop and memory consumption via a certificate with a loop in the certificate chain...
CVE-2015-7826
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting .example.com as a match for bar.foo.example.com. Otherwise valid certificates using wildcar...
Code injection
botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...
CVE-2015-7824
botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...
CVE-2016-6879
The X509Certificate::allowedusage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one KeyUsage set in the enum value...