CVE-2017-2801
Published: 24 May 2017
A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.
From the Ubuntu Security Team
It was discovered that Botan did not properly manage x509 DN strings comparisons when provided with a specially crafted X509 certificate. An attacker could possibly use this issue to cause out of bound reads, resulting in information leakage, denial of service, or potentially incorrect certificate validation results.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
botan1.10 Launchpad, Ubuntu, Debian |
cosmic |
Not vulnerable
(1.10.16-1)
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| groovy |
Does not exist
|
|
| jammy |
Does not exist
|
|
| xenial |
Needed
|
|
| trusty |
Released
(1.10.5-1+deb7u1ubuntu0.14.04.1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| precise |
Ignored
(end of life)
|
|
| artful |
Not vulnerable
(1.10.16-1)
|
|
| bionic |
Not vulnerable
(1.10.16-1)
|
|
| hirsute |
Does not exist
|
|
| upstream |
Released
(1.10.16-1)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Ignored
(end of life)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |