CVE-2016-2850

Description

Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

References

https://security.gentoo.org/glsa/201701-23

http://marc.info/?l=botan-devel&m=145852488622892&w=2

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html

http://botan.randombit.net/security.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3