Description
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
References
- [botan-devel] 20160321 Botan 1.11.29 released mailing-list
- FEDORA-2016-a545f81683 vendor-advisory
- GLSA-201701-23 vendor-advisory
- http://botan.randombit.net/security.html