653 lines
26 KiB
JSON
653 lines
26 KiB
JSON
{
|
|
"document":{
|
|
"aggregate_severity":{
|
|
"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
|
|
"text":"High"
|
|
},
|
|
"category":"csaf_vex",
|
|
"csaf_version":"2.0",
|
|
"distribution":{
|
|
"tlp":{
|
|
"label":"WHITE",
|
|
"url":"https:/www.first.org/tlp/"
|
|
}
|
|
},
|
|
"lang":"en",
|
|
"notes":[
|
|
{
|
|
"text":"botan2 security update",
|
|
"category":"general",
|
|
"title":"Synopsis"
|
|
},
|
|
{
|
|
"text":"An update for botan2 is now available for openEuler-24.03-LTS.",
|
|
"category":"general",
|
|
"title":"Summary"
|
|
},
|
|
{
|
|
"text":"Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \\#10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API reference, tutorial, and examples may help impart the flavor of the library. This is the current stable release branch 2.x of Botan.\n\nSecurity Fix(es):\n\nBotan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.(CVE-2024-34702)\n\nBotan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.\n(CVE-2024-34703)\n\nBotan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.(CVE-2024-39312)",
|
|
"category":"general",
|
|
"title":"Description"
|
|
},
|
|
{
|
|
"text":"An update for botan2 is now available for openEuler-24.03-LTS.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
|
|
"category":"general",
|
|
"title":"Topic"
|
|
},
|
|
{
|
|
"text":"High",
|
|
"category":"general",
|
|
"title":"Severity"
|
|
},
|
|
{
|
|
"text":"botan2",
|
|
"category":"general",
|
|
"title":"Affected Component"
|
|
}
|
|
],
|
|
"publisher":{
|
|
"issuing_authority":"openEuler security committee",
|
|
"name":"openEuler",
|
|
"namespace":"https://www.openeuler.org",
|
|
"contact_details":"openeuler-security@openeuler.org",
|
|
"category":"vendor"
|
|
},
|
|
"references":[
|
|
{
|
|
"summary":"openEuler-SA-2024-1923",
|
|
"category":"self",
|
|
"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1923"
|
|
},
|
|
{
|
|
"summary":"CVE-2024-34702",
|
|
"category":"self",
|
|
"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-34702&packageName=botan2"
|
|
},
|
|
{
|
|
"summary":"CVE-2024-34703",
|
|
"category":"self",
|
|
"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-34703&packageName=botan2"
|
|
},
|
|
{
|
|
"summary":"CVE-2024-39312",
|
|
"category":"self",
|
|
"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-39312&packageName=botan2"
|
|
},
|
|
{
|
|
"summary":"nvd cve",
|
|
"category":"external",
|
|
"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34702"
|
|
},
|
|
{
|
|
"summary":"nvd cve",
|
|
"category":"external",
|
|
"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34703"
|
|
},
|
|
{
|
|
"summary":"nvd cve",
|
|
"category":"external",
|
|
"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39312"
|
|
},
|
|
{
|
|
"summary":"openEuler-SA-2024-1923 vex file",
|
|
"category":"self",
|
|
"url":"https://repo.openeuler.org/security/data/csaf/advisories/2024/csaf-openEuler-SA-2024-1923.json"
|
|
}
|
|
],
|
|
"title":"An update for botan2 is now available for openEuler-24.03-LTS",
|
|
"tracking":{
|
|
"initial_release_date":"2024-08-02T19:41:56+08:00",
|
|
"revision_history":[
|
|
{
|
|
"date":"2024-08-02T19:41:56+08:00",
|
|
"summary":"Initial",
|
|
"number":"1.0.0"
|
|
},
|
|
{
|
|
"date":"2024-08-05T11:30:56+08:00",
|
|
"summary":"final",
|
|
"number":"2.0.0"
|
|
}
|
|
],
|
|
"generator":{
|
|
"date":"2024-08-05T11:30:56+08:00",
|
|
"engine":{
|
|
"name":"openEuler CSAF Tool V1.0"
|
|
}
|
|
},
|
|
"current_release_date":"2024-08-05T11:30:56+08:00",
|
|
"id":"openEuler-SA-2024-1923",
|
|
"version":"2.0.0",
|
|
"status":"final"
|
|
}
|
|
},
|
|
"product_tree":{
|
|
"branches":[
|
|
{
|
|
"name":"openEuler",
|
|
"category":"vendor",
|
|
"branches":[
|
|
{
|
|
"name":"openEuler",
|
|
"branches":[
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"openEuler-24.03-LTS",
|
|
"name":"openEuler-24.03-LTS"
|
|
},
|
|
"name":"openEuler-24.03-LTS",
|
|
"category":"product_version"
|
|
}
|
|
],
|
|
"category":"product_name"
|
|
},
|
|
{
|
|
"name":"aarch64",
|
|
"branches":[
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-devel-2.19.3-3.oe2403.aarch64.rpm",
|
|
"name":"botan2-devel-2.19.3-3.oe2403.aarch64.rpm"
|
|
},
|
|
"name":"botan2-devel-2.19.3-3.oe2403.aarch64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"name":"botan2-2.19.3-3.oe2403.aarch64.rpm"
|
|
},
|
|
"name":"botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-debugsource-2.19.3-3.oe2403.aarch64.rpm",
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.aarch64.rpm"
|
|
},
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.aarch64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"python3-botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"name":"python3-botan2-2.19.3-3.oe2403.aarch64.rpm"
|
|
},
|
|
"name":"python3-botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-debuginfo-2.19.3-3.oe2403.aarch64.rpm",
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.aarch64.rpm"
|
|
},
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.aarch64.rpm",
|
|
"category":"product_version"
|
|
}
|
|
],
|
|
"category":"product_name"
|
|
},
|
|
{
|
|
"name":"noarch",
|
|
"branches":[
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-doc-2.19.3-3.oe2403.noarch.rpm",
|
|
"name":"botan2-doc-2.19.3-3.oe2403.noarch.rpm"
|
|
},
|
|
"name":"botan2-doc-2.19.3-3.oe2403.noarch.rpm",
|
|
"category":"product_version"
|
|
}
|
|
],
|
|
"category":"product_name"
|
|
},
|
|
{
|
|
"name":"src",
|
|
"branches":[
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-2.19.3-3.oe2403.src.rpm",
|
|
"name":"botan2-2.19.3-3.oe2403.src.rpm"
|
|
},
|
|
"name":"botan2-2.19.3-3.oe2403.src.rpm",
|
|
"category":"product_version"
|
|
}
|
|
],
|
|
"category":"product_name"
|
|
},
|
|
{
|
|
"name":"x86_64",
|
|
"branches":[
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-devel-2.19.3-3.oe2403.x86_64.rpm",
|
|
"name":"botan2-devel-2.19.3-3.oe2403.x86_64.rpm"
|
|
},
|
|
"name":"botan2-devel-2.19.3-3.oe2403.x86_64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-debuginfo-2.19.3-3.oe2403.x86_64.rpm",
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.x86_64.rpm"
|
|
},
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.x86_64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"python3-botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"name":"python3-botan2-2.19.3-3.oe2403.x86_64.rpm"
|
|
},
|
|
"name":"python3-botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"name":"botan2-2.19.3-3.oe2403.x86_64.rpm"
|
|
},
|
|
"name":"botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"category":"product_version"
|
|
},
|
|
{
|
|
"product":{
|
|
"product_identification_helper":{
|
|
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
|
|
},
|
|
"product_id":"botan2-debugsource-2.19.3-3.oe2403.x86_64.rpm",
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.x86_64.rpm"
|
|
},
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.x86_64.rpm",
|
|
"category":"product_version"
|
|
}
|
|
],
|
|
"category":"product_name"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"relationships":[
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-devel-2.19.3-3.oe2403.aarch64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"name":"botan2-devel-2.19.3-3.oe2403.aarch64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"name":"botan2-2.19.3-3.oe2403.aarch64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-debugsource-2.19.3-3.oe2403.aarch64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.aarch64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"python3-botan2-2.19.3-3.oe2403.aarch64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"name":"python3-botan2-2.19.3-3.oe2403.aarch64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-debuginfo-2.19.3-3.oe2403.aarch64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.aarch64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-doc-2.19.3-3.oe2403.noarch.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"name":"botan2-doc-2.19.3-3.oe2403.noarch as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-2.19.3-3.oe2403.src.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"name":"botan2-2.19.3-3.oe2403.src as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-devel-2.19.3-3.oe2403.x86_64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"name":"botan2-devel-2.19.3-3.oe2403.x86_64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-debuginfo-2.19.3-3.oe2403.x86_64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"name":"botan2-debuginfo-2.19.3-3.oe2403.x86_64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"python3-botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"name":"python3-botan2-2.19.3-3.oe2403.x86_64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-2.19.3-3.oe2403.x86_64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"name":"botan2-2.19.3-3.oe2403.x86_64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
},
|
|
{
|
|
"relates_to_product_reference":"openEuler-24.03-LTS",
|
|
"product_reference":"botan2-debugsource-2.19.3-3.oe2403.x86_64.rpm",
|
|
"full_product_name":{
|
|
"product_id":"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64",
|
|
"name":"botan2-debugsource-2.19.3-3.oe2403.x86_64 as a component of openEuler-24.03-LTS"
|
|
},
|
|
"category":"default_component_of"
|
|
}
|
|
]
|
|
},
|
|
"vulnerabilities":[
|
|
{
|
|
"cve":"CVE-2024-34702",
|
|
"notes":[
|
|
{
|
|
"text":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.",
|
|
"category":"description",
|
|
"title":"Vulnerability Description"
|
|
}
|
|
],
|
|
"product_status":{
|
|
"fixed":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
},
|
|
"remediations":[
|
|
{
|
|
"product_ids":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
],
|
|
"details":"botan2 security update",
|
|
"category":"vendor_fix",
|
|
"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1923"
|
|
}
|
|
],
|
|
"scores":[
|
|
{
|
|
"cvss_v3":{
|
|
"baseSeverity":"MEDIUM",
|
|
"baseScore":5.3,
|
|
"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
|
"version":"3.1"
|
|
},
|
|
"products":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
}
|
|
],
|
|
"threats":[
|
|
{
|
|
"details":"Medium",
|
|
"category":"impact"
|
|
}
|
|
],
|
|
"title":"CVE-2024-34702"
|
|
},
|
|
{
|
|
"cve":"CVE-2024-34703",
|
|
"notes":[
|
|
{
|
|
"text":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.",
|
|
"category":"description",
|
|
"title":"Vulnerability Description"
|
|
}
|
|
],
|
|
"product_status":{
|
|
"fixed":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
},
|
|
"remediations":[
|
|
{
|
|
"product_ids":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
],
|
|
"details":"botan2 security update",
|
|
"category":"vendor_fix",
|
|
"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1923"
|
|
}
|
|
],
|
|
"scores":[
|
|
{
|
|
"cvss_v3":{
|
|
"baseSeverity":"HIGH",
|
|
"baseScore":7.5,
|
|
"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"version":"3.1"
|
|
},
|
|
"products":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
}
|
|
],
|
|
"threats":[
|
|
{
|
|
"details":"High",
|
|
"category":"impact"
|
|
}
|
|
],
|
|
"title":"CVE-2024-34703"
|
|
},
|
|
{
|
|
"cve":"CVE-2024-39312",
|
|
"notes":[
|
|
{
|
|
"text":"Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.",
|
|
"category":"description",
|
|
"title":"Vulnerability Description"
|
|
}
|
|
],
|
|
"product_status":{
|
|
"fixed":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
},
|
|
"remediations":[
|
|
{
|
|
"product_ids":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
],
|
|
"details":"botan2 security update",
|
|
"category":"vendor_fix",
|
|
"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1923"
|
|
}
|
|
],
|
|
"scores":[
|
|
{
|
|
"cvss_v3":{
|
|
"baseSeverity":"MEDIUM",
|
|
"baseScore":5.3,
|
|
"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"version":"3.1"
|
|
},
|
|
"products":[
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.aarch64",
|
|
"openEuler-24.03-LTS:botan2-doc-2.19.3-3.oe2403.noarch",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.src",
|
|
"openEuler-24.03-LTS:botan2-devel-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debuginfo-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:python3-botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-2.19.3-3.oe2403.x86_64",
|
|
"openEuler-24.03-LTS:botan2-debugsource-2.19.3-3.oe2403.x86_64"
|
|
]
|
|
}
|
|
],
|
|
"threats":[
|
|
{
|
|
"details":"Medium",
|
|
"category":"impact"
|
|
}
|
|
],
|
|
"title":"CVE-2024-39312"
|
|
}
|
|
]
|
|
} |