Improper input validation in Botan - CVE-2017-2801
Published: May 3, 2017 / Updated: May 4, 2017
Vulnerability identifier: #VU6398
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-2801
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose potentially sensitive information or cause (DoS) condition.
The vulnerability exists due to improper validation of X.509 certificate fields when processing a specially formed DN. A remote attacker can submit a crafted X.509 certificate to affected client or server software, bypass security restrictions and cause out of bound memory read.
Successful exploitation of the vulnerability may result in information disclosure or denial of service on the targeted system.
The vulnerability exists due to improper validation of X.509 certificate fields when processing a specially formed DN. A remote attacker can submit a crafted X.509 certificate to affected client or server software, bypass security restrictions and cause out of bound memory read.
Successful exploitation of the vulnerability may result in information disclosure or denial of service on the targeted system.
Affected software
Botan
Debian Linux
Fedora
botan
Debian Linux
Fedora
botan
How to mitigate CVE-2017-2801
Update to version 2.1.0 or 1.10.16.
botan - addressed in versions 1.8.15-2.el6, 1.10.17-1.el7, 1.10.17-1.fc25, 1.10.17-1.fc26