Detections
Analytics

Alpine: multiple botan3 packages, py3-botan3: security update to 3.5.0-r0

medium Tenable Cloud Security Plugin ID 423756

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an
 object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name
 constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker
 who presented a certificate chain which contained a very large number of names in the
 SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints,
 could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has
 also been applied and is included in Botan 2.19.5. (CVE-2024-34702)

 - Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an
 object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint
 extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded
 subtrees, only the permitted subtree would be checked. If a certificate included a name which was
 permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in
 versions 3.5.0 and 2.19.5. (CVE-2024-39312)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-34702

https://security.alpinelinux.org/vuln/CVE-2024-39312

Plugin Details

Severity: Medium

ID: 423756

Version: Revision 1.7

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2024-39312

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/8/2024

Reference Information

CVE: CVE-2024-34702, CVE-2024-39312