CVE-2024-34702
Vulnerability from cvelistv5
Published
2024-07-08 16:22
Modified
2024-08-02 02:59
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
References
security-advisories@github.comhttps://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
security-advisories@github.comhttps://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
security-advisories@github.comhttps://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
security-advisories@github.comhttps://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
security-advisories@github.comhttps://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
security-advisories@github.comhttps://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
security-advisories@github.comhttps://github.com/randombit/botan/pull/4034
security-advisories@github.comhttps://github.com/randombit/botan/pull/4045
security-advisories@github.comhttps://github.com/randombit/botan/pull/4047
security-advisories@github.comhttps://github.com/randombit/botan/pull/4052
security-advisories@github.comhttps://github.com/randombit/botan/pull/4186
security-advisories@github.comhttps://github.com/randombit/botan/pull/4187
security-advisories@github.comhttps://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4034
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4045
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4047
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4052
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4186
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/pull/4187
af854a3a-2127-422b-91ae-364da2661108https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j
Impacted products
Vendor Product Version
randombit botan Version: < 2.19.5
Version: >= 3.0.0, < 3.5.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:randombit:botan:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "botan",
                  vendor: "randombit",
                  versions: [
                     {
                        lessThan: "3.5.0",
                        status: "affected",
                        version: "3.0.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.19.5",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-34702",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-08T17:49:00.765800Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-08T20:14:23.465Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T02:59:22.209Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4034",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4034",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4045",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4045",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4047",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4047",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4052",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4052",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4186",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4186",
               },
               {
                  name: "https://github.com/randombit/botan/pull/4187",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/pull/4187",
               },
               {
                  name: "https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e",
               },
               {
                  name: "https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac",
               },
               {
                  name: "https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1",
               },
               {
                  name: "https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf",
               },
               {
                  name: "https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41",
               },
               {
                  name: "https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "botan",
               vendor: "randombit",
               versions: [
                  {
                     status: "affected",
                     version: "< 2.19.5",
                  },
                  {
                     status: "affected",
                     version: ">= 3.0.0, < 3.5.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-405",
                     description: "CWE-405: Asymmetric Resource Consumption (Amplification)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-07-08T16:22:37.770Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j",
            },
            {
               name: "https://github.com/randombit/botan/pull/4034",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4034",
            },
            {
               name: "https://github.com/randombit/botan/pull/4045",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4045",
            },
            {
               name: "https://github.com/randombit/botan/pull/4047",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4047",
            },
            {
               name: "https://github.com/randombit/botan/pull/4052",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4052",
            },
            {
               name: "https://github.com/randombit/botan/pull/4186",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4186",
            },
            {
               name: "https://github.com/randombit/botan/pull/4187",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/pull/4187",
            },
            {
               name: "https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e",
            },
            {
               name: "https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac",
            },
            {
               name: "https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1",
            },
            {
               name: "https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf",
            },
            {
               name: "https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41",
            },
            {
               name: "https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8",
            },
         ],
         source: {
            advisory: "GHSA-5gg9-hqpr-r58j",
            discovery: "UNKNOWN",
         },
         title: "Botan has a Denial of Service Due to Excessive Name Constraints",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-34702",
      datePublished: "2024-07-08T16:22:37.770Z",
      dateReserved: "2024-05-07T13:53:00.132Z",
      dateUpdated: "2024-08-02T02:59:22.209Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-34702\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-08T17:15:11.233\",\"lastModified\":\"2024-11-21T09:19:13.673\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.\"},{\"lang\":\"es\",\"value\":\"Botan es una librería de criptografía C++. Los certificados X.509 pueden identificar curvas elípticas utilizando un identificador de objeto o una codificación explícita de los parámetros. Antes de 3.5.0 y 2.19.5, la verificación de las restricciones de nombres en los certificados X.509 era cuadrática en el número de nombres y restricciones de nombres. Un atacante que presentara una cadena de certificados que contuviera una gran cantidad de nombres en el SubjectAlternativeName, firmado por un certificado de CA que contuviera una gran cantidad de restricciones de nombres, podría provocar una denegación de servicio. El problema se solucionó en Botan 3.5.0 y también se aplicó un backport parcial que se incluye en Botan 2.19.5.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-405\"}]}],\"references\":[{\"url\":\"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4034\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4045\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4047\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4052\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4186\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/pull/4187\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4034\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4045\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4047\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4052\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4186\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/pull/4187\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\", \"name\": \"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4034\", \"name\": \"https://github.com/randombit/botan/pull/4034\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4045\", \"name\": \"https://github.com/randombit/botan/pull/4045\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4047\", \"name\": \"https://github.com/randombit/botan/pull/4047\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4052\", \"name\": \"https://github.com/randombit/botan/pull/4052\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4186\", \"name\": \"https://github.com/randombit/botan/pull/4186\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4187\", \"name\": \"https://github.com/randombit/botan/pull/4187\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\", \"name\": \"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\", \"name\": \"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\", \"name\": \"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\", \"name\": \"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\", \"name\": \"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\", \"name\": \"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:59:22.209Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-34702\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-08T17:49:00.765800Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:randombit:botan:*:*:*:*:*:*:*:*\"], \"vendor\": \"randombit\", \"product\": \"botan\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.5.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.19.5\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-08T17:59:30.555Z\"}}], \"cna\": {\"title\": \"Botan has a Denial of Service Due to Excessive Name Constraints\", \"source\": {\"advisory\": \"GHSA-5gg9-hqpr-r58j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"randombit\", \"product\": \"botan\", \"versions\": [{\"status\": \"affected\", \"version\": \"< 2.19.5\"}, {\"status\": \"affected\", \"version\": \">= 3.0.0, < 3.5.0\"}]}], \"references\": [{\"url\": \"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\", \"name\": \"https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4034\", \"name\": \"https://github.com/randombit/botan/pull/4034\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4045\", \"name\": \"https://github.com/randombit/botan/pull/4045\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4047\", \"name\": \"https://github.com/randombit/botan/pull/4047\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4052\", \"name\": \"https://github.com/randombit/botan/pull/4052\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4186\", \"name\": \"https://github.com/randombit/botan/pull/4186\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/pull/4187\", \"name\": \"https://github.com/randombit/botan/pull/4187\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\", \"name\": \"https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\", \"name\": \"https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\", \"name\": \"https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\", \"name\": \"https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\", \"name\": \"https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\", \"name\": \"https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-405\", \"description\": \"CWE-405: Asymmetric Resource Consumption (Amplification)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-08T16:22:37.770Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-34702\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T02:59:22.209Z\", \"dateReserved\": \"2024-05-07T13:53:00.132Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-08T16:22:37.770Z\", \"assignerShortName\": \"GitHub_M\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.