Input validation error in Fedora and Botan - CVE-2016-2850

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40296

Input validation error in Fedora and Botan - CVE-2016-2850

Published: May 13, 2016 / Updated: August 9, 2020


Vulnerability identifier: #VU40296
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-2850
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Fedoraproject
Randombit
Affected software:
Fedora
Botan

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.


How to mitigate CVE-2016-2850

Install update from vendor's website.

Sources