Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7f42bafbdb advisory.

    Rebase to v2.19.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6d84a608f1 advisory.

    Rebase to v2.19.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0201-1 advisory.

    Update to 2.19.5:

    * Fix multiple Denial of service attacks due to X.509 cert processing:
    * CVE-2024-34702 - boo#1227238
    * CVE-2024-34703 - boo#1227607
    * CVE-2024-39312 - boo#1227608
    * Fix a crash in OCB
    * Fix a test failure in compression with certain versions of zlib
    * Fix some iterator debugging errors in TLS CBC decryption.
    * Avoid a miscompilation in ARIA when using XCode 14

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202732	Fedora 40 : botan2 (2024-7f42bafbdb)	Nessus	Fedora Local Security Checks	medium
202731	Fedora 39 : botan2 (2024-6d84a608f1)	Nessus	Fedora Local Security Checks	medium
202559	openSUSE 15 Security Update : Botan (openSUSE-SU-2024:0201-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-39312

medium

Tenable Plugins

medium

medium

medium