Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.
References
| Link | Resource |
|---|---|
| https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86 | Third Party Advisory |
| https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
11 Apr 2025, 14:09
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-295 |
05 Mar 2025, 14:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:botan_project:botan:*:*:*:*:*:*:*:* | |
| First Time |
Botan Project botan
Botan Project |
08 Jul 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-08 17:15
Updated : 2025-04-11 14:09
NVD link : CVE-2024-39312
Mitre link : CVE-2024-39312
JSON object : View
Products Affected
botan_project
- botan
CWE
CWE-295
Improper Certificate Validation