CVE catalog

CVE-2018-9127

botan: CVE-2018-9127

Severity: Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Apr 2, 2018, 5:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.93% · Oct 27, 2026

Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	botan	trixie	`2.19.5+dfsg-4`	fixed
Debian	botan	bookworm	`2.19.3+dfsg-1+deb12u1`	fixed
Alpine	botan	3.11	`2.5.0-r0`	fixed
Alpine	botan	3.12	`2.5.0-r0`	fixed
Alpine	botan	3.13	`2.5.0-r0`	fixed
Alpine	botan	3.14	`2.5.0-r0`	fixed
Alpine	botan	3.15	`2.5.0-r0`	fixed
Alpine	botan	3.16	`2.5.0-r0`	fixed
Alpine	botan	3.17	`2.5.0-r0`	fixed
Alpine	botan	3.18	`2.5.0-r0`	fixed
Alpine	botan	3.19	`2.5.0-r0`	fixed
Alpine	botan	3.20	`2.5.0-r0`	fixed
Alpine	botan	3.21	`2.5.0-r0`	fixed
Ubuntu	botan	20.04	`2.9.0-2`	vulnerable
Ubuntu	botan	20.04	`2.9.0-2build1`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2build1`	vulnerable
Ubuntu	botan	pro	`2.17.3+dfsg-3`	vulnerable
Ubuntu	botan	pro	`2.19.1+dfsg-2ubuntu1`	vulnerable
Ubuntu	botan	pro	`2.19.1+dfsg-2ubuntu1+esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	botan	source	trixie	`2.4.0-5`	not yet assigned	Not reported	[894648]
Debian	botan	source	bookworm	`2.4.0-5`	not yet assigned	Not reported	[894648]
Alpine	botan	apk	3.11	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.12	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.13	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.14	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.15	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.16	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.17	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.18	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.19	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.20	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported
Alpine	botan	apk	3.21	`2.5.0-r0`	Not reported	ALPINE-CVE-2018-9127	Not reported

[Debian bug #894648]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[botan]Unknown
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
[python3-botan]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · bookworm; dsa · botan · debian · 12

[Debian 13 (Trixie)]

[botan]Unknown
Source package: [botan3]
Details (4)
- 3.7.1+dfsg-2 · amd64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 3.7.1+dfsg-2 · arm64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.4.0-5
  dsa · botan · debian · 13

Observed: Oct 23, 2026, 5:37:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]