CVE-2018-9860

Botan CVE-2018-9860 affects Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext can cause the receiver to include 64K bytes following the record buffer in the HMAC, leading to a denial of service (MAC check fails and connection closes). No info...

CVE-2018-9860

An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will...

CVE-2018-9860

An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will...

botan/tls_client: Crash in unsigned long Botan::load_be<unsigned long>

Project: https://github.com/randombit/botan.git Detailed report: https://oss-fuzz.com/testcase?key=5945229455654912 Project: botan Fuzzer: libFuzzerbotantlsclient Fuzz target binary: tlsclient Job Type: libfuzzermsanbotan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x703000010000...

botan/tls_client: Heap-buffer-overflow in void Botan::copy_mem<unsigned char>

Project: https://github.com/randombit/botan.git Detailed report: https://oss-fuzz.com/testcase?key=4905819050082304 Project: botan Fuzzer: libFuzzerbotantlsclient Fuzz target binary: tlsclient Job Type: libfuzzerasanbotan Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

Botan Design Vulnerability (CNVD-2018-08488)

Botan is a library of cryptographic algorithms in the C++ programming language that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security vulnerability exists in Botan versions 2.2.0 through 2.4.0, which stems from the program failing to properly match wildcard certificates. An attack...

Code injection

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

ALPINE-CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

UBUNTU-CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

DEBIAN-CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

CVE-2018-9127 affects Botan library versions 2.2.0–2.4.0; the issue arises from improper wildcard certificate handling, allowing certain certificates to be treated as valid for hostnames under RFC 6125 rules within the same domain. The vulnerability could enable host impersonation if an attacker ...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

botan/invert: Use-of-uninitialized-value in Botan::word_add

Project: https://github.com/randombit/botan.git Detailed report: https://oss-fuzz.com/testcase?key=5113093358092288 Project: botan Fuzzer: libFuzzerbotaninvert Fuzz target binary: invert Job Type: libfuzzermsanbotan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

botan/pkcs8: Heap-buffer-overflow in Botan::bigint_monty_redc

Project: https://github.com/randombit/botan.git Detailed report: https://oss-fuzz.com/testcase?key=5182248321024000 Project: botan Fuzzer: libFuzzerbotanpkcs8 Fuzz target binary: pkcs8 Job Type: libfuzzerasanbotan Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...