CVE-2024-39312

Severity CVSS v4.0:

Pending analysis

Type:

CWE-295 Improper Certificate Validation

Publication date:

08/07/2024

Last modified:

11/04/2025

Description

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.30 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): None

Base Score 3.x

5.30

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:botan_project:botan::::::::		2.19.5 (excluding)
cpe:2.3:a:botan_project:botan::::::::	3.0.0 (including)	3.5.0 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2024-39312

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools