Detections
Analytics
Alpine: multiple botan packages: security update to 2.5.0-r0
critical Tenable Cloud Security Plugin ID 423750
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain
certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects
certificates issued to the same domain as the host, so to impersonate a host one must already have a
wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some
hostnames that do not begin with a 'b' character. (CVE-2018-9127)
See Also
Plugin Details
Severity: Critical
ID: 423750
Version: Revision 1.7
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.15
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-9127
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 4/2/2018
Reference Information
CVE: CVE-2018-9127