CVE-2024-34703

EUVD-2024-34998
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.
Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub_MCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Debian logo
Debian Releases
Debian Product
Codename
botan
bookworm
2.19.3+dfsg-1+deb12u1
fixed
bullseye
no-dsa
trixie
2.19.5+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
botan
bionic
not-affected
focal
needed
jammy
Fixed 2.19.1+dfsg-2ubuntu1+esm1
released
mantic
ignored
noble
Fixed 2.19.3+dfsg-1ubuntu2+esm1
released
oracular
Fixed 2.19.3+dfsg-1ubuntu2.1
released
plucky
not-affected
questing
not-affected