Nixpkgs security tracker
5.9 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
9 packages
- botan2
- botanEsdm
- emiluaPlugins.botan
- python312Packages.botan3
- python313Packages.botan3
- python314Packages.botan3
- haskellPackages.botan-low
- haskellPackages.botan-bindings
- chickenPackages_5.chickenEggs.botan
- @mweinelt accepted
- @mweinelt published on GitHub
Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by the DNS name constraints, even though this check is technically not required by RFC 5280. However this check failed to account for the possibility of a mixed-case CN. Thus a certificate with CN=Sub.EVIL.COM and no subject alternative name would bypasses an excludedSubtrees constraint for evil.com because the comparison is case-sensitive. This issue has been patched in version 3.11.0.
References
-
https://github.com/randombit/botan/security/advisories/GHSA-7c3g-7763-ggj5 x_refsource_CONFIRM
Affected products
- ==< 3.11.0
Matching in nixpkgs
Ignored packages (9)
pkgs.botan2
None
pkgs.botanEsdm
Cryptographic algorithms library
pkgs.emiluaPlugins.botan
Securely clears secrets from memory in Emilua
pkgs.python312Packages.botan3
None
pkgs.python313Packages.botan3
Python Bindings for botan3 cryptography library
-
nixos-unstable botan3-3.11.0
- nixpkgs-unstable botan3-3.11.0
- nixos-unstable-small botan3-3.11.0
pkgs.python314Packages.botan3
Python Bindings for botan3 cryptography library
-
nixos-unstable botan3-3.11.0
- nixpkgs-unstable botan3-3.11.0
- nixos-unstable-small botan3-3.11.0
pkgs.haskellPackages.botan-low
Low-level Botan bindings
pkgs.haskellPackages.botan-bindings
Raw Botan bindings
pkgs.chickenPackages_5.chickenEggs.botan
None
Package maintainers
-
@nikstur nikstur <nikstur@outlook.com>
-
@thillux Markus Theil <theil.markus@gmail.com>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>