SecuriTricks - CVE-2024-39312

Description

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.

Product(s) Impacted

Product	Versions
Botan	3.5.0 2.19.5

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References

https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86

CVSS Score

5.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

View Vector String

Timeline

Published: July 8, 2024, 5:15 p.m.
Last Modified: July 8, 2024, 5:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CVE-2024-39312