high7.5
CVE-2016-2850
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade att…
Impact
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fedoraproject | Fedora | Version 24 |
| Botan Project | Botan | Versions 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.11.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://botan.randombit.net/security.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html
- http://marc.info/?l=botan-devel&m=145852488622892&w=2
- https://security.gentoo.org/glsa/201701-23
- http://botan.randombit.net/security.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html
- http://marc.info/?l=botan-devel&m=145852488622892&w=2
- https://security.gentoo.org/glsa/201701-23