Page 2 of 29 results (0.006 seconds)

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-9127

https://notcve.org/view.php?id=CVE-2018-9127

02 Apr 2018 — Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character. Botan 2.2.0 - 2.4.0 (solucionado en 2.5.0) ges... • https://botan.randombit.net/security.html • CWE-295: Improper Certificate Validation •

CVSS: 5.5EPSS: 0%CPEs: 37EXPL: 0

CVE-2017-14737

https://notcve.org/view.php?id=CVE-2017-14737

26 Sep 2017 — A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key. Un canal lateral criptográfico basado en caché en la implementación RSA en Botan en versiones anteriores a la 1.10.17 y las versiones 1.11.x y 2.x anteriores a la 2.3.0 permite que un atacante local recupere infor... • https://github.com/randombit/botan/issues/1222 •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-2801

https://notcve.org/view.php?id=CVE-2017-2801

24 May 2017 — A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability. Existe un error de programación en una manera en que la biblioteca criptográfica Randombit Botan versión 2.0.1, implementa comparaciones de cadenas x500 que podrían conllevar problemas d... • http://talosintelligence.com/vulnerability_reports/TALOS-2017-0294 • CWE-125: Out-of-bounds Read •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-7825

https://notcve.org/view.php?id=CVE-2015-7825

10 Apr 2017 — botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain. botan en versiones anteriores a 1.11.22 valida incorrectamente las rutas de certificados, lo que permite a atacantes remotos provocar una denegación de servicio (bucle infinito y consumo de memoria) a través de un certificado con un bucle en la cadena de certificados. • https://botan.randombit.net/security.html#id3 •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-6878

https://notcve.org/view.php?id=CVE-2016-6878

10 Apr 2017 — The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang. El código Curve25519 en botan en versiones anteriores a 1.11.31, en sistemas sin un tipo entero nativo de 128 bits, podría permitir a los atacantes tener un impacto no especificado a través de vectores relacionados con un comportamiento indefinido, como se demuestra e... • https://botan.randombit.net/security.html#id2 • CWE-20: Improper Input Validation •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-7826

https://notcve.org/view.php?id=CVE-2015-7826

10 Apr 2017 — botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com. botan 1.11.x en versiones anteriores a 1.11.22 maneja incorrectamente la coincidencia de comodines contra nombres de host, lo que podría permitir que atacantes remotos tengan impacto no especificado a través de un certificado X.509 válido, como se demuestr... • https://botan.randombit.net/security.html#id3 • CWE-295: Improper Certificate Validation •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-7824

https://notcve.org/view.php?id=CVE-2015-7824

10 Apr 2017 — botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. botan 1.11.x en versiones anteriores a 1.11.22 hace que sea más fácil para los atacantes remotos descifrar los datos de texto cifrado TLS a través de un ataque padding-oracle contra TLS CBC ciphersuites. • https://botan.randombit.net/security.html#id3 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0

CVE-2016-6879

https://notcve.org/view.php?id=CVE-2016-6879

10 Apr 2017 — The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value. La función X509_Certificate::allowed_usage en botan 1.11.x en versiones anteriores a 1.11.31 podría permitir a los atacantes tener un impacto no especificado aprovechando una llamada con más de un Key_Usage establecido en el valor enum. • https://botan.randombit.net/security.html#id2 • CWE-320: Key Management Errors •

CVSS: 9.8EPSS: 0%CPEs: 84EXPL: 0

CVE-2016-9132

https://notcve.org/view.php?id=CVE-2016-9132

30 Jan 2017 — In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure. En Botan 1.8.0 hasta la versión 1.11.33, al decodificar datos BER podría producirse un desbordamiento de enteros, lo que causaría que se calculara un campo de longitud incorrecto. Algunos llamadores API pueden uti... • http://www.securityfocus.com/bid/95879 • CWE-190: Integer Overflow or Wraparound •

CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0

CVE-2016-8871

https://notcve.org/view.php?id=CVE-2016-8871

28 Oct 2016 — In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack. En Botan 1.11.29 hasta la versión 1.11.32, descifrado RSA con ciertas opciones de relleno tenía un canal de sincronización detectable lo que podría dadas las suficientes consultas, se utilizado para recuperar texto plano, vulnerabilidad también conocida como un ataque "OAEP side channel". • http://www.securityfocus.com/bid/94225 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •