9 results · Feed
-
Medium 5.3
Botan has an Authorization Error due to Name Constraint Decoding Bug
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the ext…
-
Medium 5.3
Botan has a Denial of Service Due to Excessive Name Constraints
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the…
-
High 7.5
Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using…
-
Unscored —
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recover…
-
Unscored —
In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, b…
-
Unscored —
A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken fo…
-
Unscored —
Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of…
-
Unscored —
An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CB…
-
Unscored —
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as …