Filtered by vendor Botan Project
Subscribe
Search
Total
8 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-24115 | 1 Botan Project | 1 Botan | 2021-02-26 | 7.5 HIGH | 9.8 CRITICAL |
| In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and hex). | |||||
| CVE-2018-9127 | 1 Botan Project | 1 Botan | 2018-05-15 | 7.5 HIGH | 9.8 CRITICAL |
| Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character. | |||||
| CVE-2017-2801 | 1 Botan Project | 1 Botan | 2017-11-04 | 7.5 HIGH | 9.8 CRITICAL |
| A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability. | |||||
| CVE-2016-2195 | 2 Botan Project, Debian | 2 Botan, Debian Linux | 2017-07-01 | 10.0 HIGH | 9.8 CRITICAL |
| Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow. | |||||
| CVE-2016-6878 | 1 Botan Project | 1 Botan | 2017-04-15 | 7.5 HIGH | 9.8 CRITICAL |
| The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang. | |||||
| CVE-2015-7826 | 1 Botan Project | 1 Botan | 2017-04-15 | 7.5 HIGH | 9.8 CRITICAL |
| botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com. | |||||
| CVE-2016-9132 | 1 Botan Project | 1 Botan | 2017-03-02 | 7.5 HIGH | 9.8 CRITICAL |
| In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure. | |||||
| CVE-2016-2196 | 1 Botan Project | 1 Botan | 2016-05-16 | 10.0 HIGH | 9.8 CRITICAL |
| Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (memory overwrite and crash) or execute arbitrary code via unspecified vectors. | |||||