Detections
Analytics
Alpine: botan: security update to 2.19.5-r0
medium Tenable Self-Hosted Container Security Plugin ID 408533
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an
object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name
constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker
who presented a certificate chain which contained a very large number of names in the
SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints,
could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has
also been applied and is included in Botan 2.19.5. (CVE-2024-34702)
- Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an
object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an
attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very
large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked
to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime
parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that
support for explicit encoding of elliptic curve parameters is deprecated in Botan. (CVE-2024-34703)
- Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an
object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint
extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded
subtrees, only the permitted subtree would be checked. If a certificate included a name which was
permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in
versions 3.5.0 and 2.19.5. (CVE-2024-39312)
See Also
https://security.alpinelinux.org/vuln/CVE-2024-34702
Plugin Details
Severity: Medium
ID: 408533
Version: Revision 1.4
Type: Local
Published: 10/9/2024
Updated: 2/2/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2024-39312
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 6/30/2024