CVE catalog

CVE-2017-2801

botan1.10 - security update

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 27, 2026

A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntubotan1.10pro1.10.5-1vulnerable
Ubuntubotan1.10pro1.10.5-1ubuntu1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1vulnerable
Ubuntubotan1.10pro1.10.5-1+deb7u1ubuntu0.14.04.1+esm1fixed
Ubuntubotan1.1016.041.10.10-6vulnerable
Ubuntubotan1.1016.041.10.12-1vulnerable
Debianbotan1.1071.10.5-1vulnerable
Debianbotan1.1071.10.5-1+deb7u1vulnerable
Debianbotan1.1071.10.5-1+deb7u2vulnerable
Debianbotan1.1071.10.5-1+deb7u3fixed
Debianbotan1.1081.10.8-2vulnerable
Debianbotan1.1081.10.8-2+deb8u1vulnerable
Debianbotan1.1081.10.8-2+deb8u2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntubotan1.10debpro1.10.5-1+deb7u1ubuntu0.14.04.1+esm1Not reportedUBUNTU-CVE-2017-2801Not reported
Debianbotan1.10deb71.10.5-1+deb7u3Not reportedDLA-915-1Not reported
Debianbotan1.10deb81.10.8-2+deb8u2Not reportedDSA-3939-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]