CRITICAL🇵🇱 Wersja polska

CVE-2018-9127

CVSS 9.8v3.0pub. 2018-04-02upd. 2024-11-21

Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Botan Project Botan

    APP
    Botan Project
    2.2.0 – 2.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-34580CRITICAL9.3PL ✓same product

Botan: błędna weryfikacja certyfikatu umożliwia obejście łańcucha zaufania

CVE-2022-43705CRITICAL9.1PL ✓same product

Fałszowanie odpowiedzi OCSP w bibliotece Botan — błąd weryfikacji certyfikatów

CVE-2021-24115CRITICAL9.8PL ✓same product

Botan: brak obliczeń constant-time w operacjach kodowania/dekodowania

CVE-2016-6878CRITICAL9.8PL ✓same product

Niezdefiniowane zachowanie w Curve25519 biblioteki Botan na platformach 32-bitowych

CVE-2015-7826CRITICAL9.8PL ✓same product

Nieprawidłowa walidacja wildcard w certyfikatach X.509 w Botan