Description (CNA)
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://marc.info/?l=botan-devel&m=145852488622892&w=2
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html
- https://security.gentoo.org/glsa/201701-23
- http://botan.randombit.net/security.html
ADP enrichment
No English description supplied.