Nixpkgs security tracker
NIXPKGS-2026-0881
GitHub issue
published on
Permalink
CVE-2026-32883
5.9 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): HIGH
- Availability impact (A): NONE
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
9 packages
- botan2
- botanEsdm
- emiluaPlugins.botan
- python312Packages.botan3
- python313Packages.botan3
- python314Packages.botan3
- haskellPackages.botan-low
- haskellPackages.botan-bindings
- chickenPackages_5.chickenEggs.botan
- @mweinelt accepted
- @mweinelt published on GitHub
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
References
-
https://github.com/randombit/botan/security/advisories/GHSA-9j2j-hqmc-hf5x x_refsource_CONFIRM
Affected products
botan
- ==>= 3.0.0, < 3.11.0
Matching in nixpkgs
Ignored packages (9)
pkgs.botan2
Cryptographic algorithms library
pkgs.botanEsdm
Cryptographic algorithms library
pkgs.emiluaPlugins.botan
Securely clears secrets from memory in Emilua
pkgs.python312Packages.botan3
Python Bindings for botan3 cryptography library
-
nixos-25.11 botan3-3.10.0
- nixos-25.11-small botan3-3.10.0
- nixpkgs-25.11-darwin botan3-3.10.0
pkgs.python313Packages.botan3
Python Bindings for botan3 cryptography library
-
nixos-unstable botan3-3.11.0
- nixpkgs-unstable botan3-3.11.0
- nixos-unstable-small botan3-3.11.0
-
nixos-25.11 botan3-3.10.0
- nixos-25.11-small botan3-3.10.0
- nixpkgs-25.11-darwin botan3-3.10.0
pkgs.python314Packages.botan3
Python Bindings for botan3 cryptography library
-
nixos-unstable botan3-3.11.0
- nixpkgs-unstable botan3-3.11.0
- nixos-unstable-small botan3-3.11.0
pkgs.haskellPackages.botan-low
Low-level Botan bindings
pkgs.haskellPackages.botan-bindings
Raw Botan bindings
pkgs.chickenPackages_5.chickenEggs.botan
Bindings to the Botan cryptographic library
Package maintainers
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
-
@thillux Markus Theil <theil.markus@gmail.com>