Botan vulnerabilities

Botan before 1.11.22 improperly validates certificate paths, allowing remote attackers to cause a denial of service via a certificate with a loop in the certificate chain.

Botan versions 1.11.x before 1.11.22 are vulnerable to a padding-oracle attack that allows remote attackers to decrypt TLS ciphertext data using CBC ciphersuites.

Botan versions 1.11.x before 1.11.29 do not enforce TLS policy for signature algorithms and ECC curves, allowing remote attackers to conduct downgrade attacks.

Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.

Botan before 1.10.13 and 1.11.x before 1.11.22 makes it easier for remote attackers to conduct million-message attacks by measuring time differences related to decoding of PKCS#1 padding.

The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.

The BER decoder in Botan versions 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause an application crash via an empty BIT STRING in ASN.1 data.

The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, making it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.

In the Botan C++ cryptography library, the C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher, causing the reported size to be truncated, insufficient memory allocation, and later memory corruption. The issue is fixed in version 3.13.0.

In Botan's TLS 1.3 implementation before version 3.11.1, ApplicationData records can be processed before the Finished message is received. This allows a client to bypass certificate-based authentication.

Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.

In Botan versions 1.8.0 through 1.11.33, an integer overflow could occur when decoding BER data, leading to an incorrect length field being computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way that later causes memory corruption or other failures.

Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory and possibly execute arbitrary code via a crafted ECC point, which triggers a heap-based buffer overflow.

In the Botan library, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected; the issue is fixed in version 3.13.0.

In the Botan library, the Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. The issue is fixed in version 3.13.0.

In the Botan library, the online OCSP client prior to 3.13.0 allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service, resulting in blind SSRF; response timing can provide a coarse internal-service oracle. The issue is fixed in version 3.13.0.

In the Botan C++ cryptography library, from 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This is fixed in version 3.13.0.

In the Botan C++ cryptography library version 3.11.0, the function Certificate_Store::certificate_known had a misleading name; it returned true if any certificate in the store had a matching DN (and subject key identifier, if set) but did not check if the certificates were identical. In 3.11.0, path validation logic was extended assuming certificate_known only returns true for identical certificates. As a result, an end entity certificate with a DN matching a trusted root is accepted as a trusted root. This vulnerability is fixed in version 3.11.1.