SB2018040210 - Security restrictions bypass in Botan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018040210

SB2018040210 - Security restrictions bypass in Botan

Published: April 2, 2018 Updated: August 3, 2020

Security Bulletin ID SB2018040210
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Certificate Validation (CVE-ID: CVE-2018-9127)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to Botan 2.2.0 - 2.4.0 improperly handles wildcard certificates and  accepts certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.


Remediation

Install update from vendor's website.

References