Resource exhaustion in Botan - CVE-2024-34703

Vulnerability identifier: #VU96994

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-34703

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing X.509 certificates. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Botan
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Fedora
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Package Hub 15
openSUSE Leap
openEuler
botan2-doc
botan2-debuginfo
botan2-devel
botan2-debugsource
python3-botan2
botan2
MozillaThunderbird
MozillaThunderbird-debugsource
MozillaThunderbird-translations-other
MozillaThunderbird-debuginfo
MozillaThunderbird-translations-common

Install updates from vendor's website.

Botan - addressed in versions 2.19.4, 3.3.0
botan2-doc - update to 2.19.3-3
botan2-debuginfo - update to 2.19.3-3
botan2-devel - update to 2.19.3-3
botan2-debugsource - update to 2.19.3-3
python3-botan2 - update to 2.19.3-3
botan2 - update to 2.19.3-3
botan2 - addressed in versions 2.19.5-1.el9, 2.19.5-1.fc39, 2.19.5-1.fc40
MozillaThunderbird - update to 115.12.2-150200.8.168.1
MozillaThunderbird-debugsource - update to 115.12.2-150200.8.168.1
MozillaThunderbird-translations-other - update to 115.12.2-150200.8.168.1
MozillaThunderbird-debuginfo - update to 115.12.2-150200.8.168.1
MozillaThunderbird-translations-common - update to 115.12.2-150200.8.168.1

• https://github.com/randombit/botan/security/advisories/GHSA-w4g2-7m2h-7xj7
• https://github.com/randombit/botan/commit/08c404b23740babee1f6aa51b54e966029aadee4
• https://github.com/randombit/botan/commit/94e9154c143aa5264da6254a6a1be5bc66ee2b5a

• Denial of service in Botan
• SUSE update for MozillaThunderbird
• Fedora 40 update for botan2
• Fedora 39 update for botan2
• Fedora EPEL 9 update for botan2
• openEuler 24.03 LTS update for botan2
• openEuler 22.03 LTS SP3 update for botan2
• openEuler 22.03 LTS SP4 update for botan2