CVE catalog

CVE-2024-34702

Botan vulnerabilities

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jul 8, 2024, 5:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.84% · Oct 25, 2026

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	botan	trixie	`2.19.5+dfsg-4`	fixed
Debian	botan	bookworm	`2.19.3+dfsg-1+deb12u1`	fixed
Ubuntu	botan	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-19	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-dev	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-doc	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	python3-botan	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Alpine	botan	3.17	`2.19.5-r0`	fixed
Alpine	botan	3.18	`2.19.5-r0`	fixed
Alpine	botan	3.19	`2.19.5-r0`	fixed
Alpine	botan	3.20	`2.19.5-r0`	fixed
Alpine	botan	3.21	`2.19.5-r0`	fixed
Alpine	botan3	3.21	`3.5.0-r0`	fixed
Alpine	botan3	3.22	`3.5.0-r0`	fixed
Alpine	botan3	3.23	`3.5.0-r0`	fixed
Alpine	botan3	3.24	`3.5.0-r0`	fixed
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu1`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	botan	18.04	`2.4.0-3`	vulnerable
Ubuntu	botan	18.04	`2.4.0-4`	vulnerable
Ubuntu	botan	18.04	`2.4.0-5ubuntu1`	vulnerable
Ubuntu	botan	20.04	`2.9.0-2`	vulnerable
Ubuntu	botan	20.04	`2.9.0-2build1`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2build1`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu1`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Opensuse	Botan	tumbleweed	`2.19.5-1.1`	fixed
Suse	Botan	package hub 15 sp5	`2.19.5-bp155.2.3.1`	fixed
Opensuse	Botan	leap 15.5	`2.19.5-bp155.2.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	botan	source	trixie	`2.19.5+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	botan	source	bookworm	`2.19.3+dfsg-1+deb12u1`	not yet assigned	Not reported	Not reported
Ubuntu	botan	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-19	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-dev	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-doc	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	python3-botan	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Alpine	botan	apk	3.17	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan	apk	3.18	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan	apk	3.19	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan	apk	3.20	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan	apk	3.21	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan3	apk	3.21	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan3	apk	3.22	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan3	apk	3.23	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Alpine	botan3	apk	3.24	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-34702	Not reported
Ubuntu	botan	deb	pro	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	USN-7586-1	Not reported
Ubuntu	botan	deb	pro	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	UBUNTU-CVE-2024-34702	Not reported
Opensuse	Botan	rpm	tumbleweed	`2.19.5-1.1`	Not reported	OPENSUSE-SU-2024:14188-1	Not reported
Suse	Botan	rpm	package hub 15 sp5	`2.19.5-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0201-1	Not reported
Opensuse	Botan	rpm	leap 15.5	`2.19.5-bp155.2.3.1`	Not reported	OPENSUSE-SU-2024:0201-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[botan]Unknown
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[python3-botan]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12

[Debian 13 (Trixie)]

[botan]Unknown
Source package: [botan3]
Details (4)
- 3.7.1+dfsg-2 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.7.1+dfsg-2 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13

[openSUSE Tumbleweed]

[Botan]Unknown
Source package: [Botan]
Details (1)
- 3.11.1-1.4 · x86_64 · tumbleweed
  Fixed · Fixed: 2.19.5-1.1
  usn · Botan · opensuse · tumbleweed
[Botan-doc]Unknown
Source package: [Botan]
Details (1)
- 3.11.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 2.19.5-1.1
  Version impact unknown
  usn · Botan · opensuse · tumbleweed
[libbotan-3-11]Unknown
Source package: [Botan]
Details (1)
- 3.11.1-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.19.5-1.1
  Version impact unknown
  usn · Botan · opensuse · tumbleweed
[libbotan-devel]Unknown
Source package: [Botan]
Details (1)
- 3.11.1-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.19.5-1.1
  Version impact unknown
  usn · Botan · opensuse · tumbleweed
[python3-botan]Unknown
Source package: [Botan]
Details (1)
- 3.11.1-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 2.19.5-1.1
  Version impact unknown
  usn · Botan · opensuse · tumbleweed

Observed: Oct 27, 2026, 3:14:29 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]