CVE catalog

CVE-2024-39312

Botan vulnerabilities

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Jul 8, 2024, 5:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.27% · Oct 25, 2026

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	botan	trixie	`2.19.5+dfsg-4`	fixed
Debian	botan	bookworm	`2.19.3+dfsg-1+deb12u1`	fixed
Ubuntu	botan	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-19	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-dev	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	libbotan-2-doc	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Ubuntu	python3-botan	noble	`2.19.3+dfsg-1ubuntu2+esm1`	fixed
Alpine	botan	3.17	`2.19.5-r0`	fixed
Alpine	botan	3.18	`2.19.5-r0`	fixed
Alpine	botan	3.19	`2.19.5-r0`	fixed
Alpine	botan	3.20	`2.19.5-r0`	fixed
Alpine	botan	3.21	`2.19.5-r0`	fixed
Alpine	botan3	3.21	`3.5.0-r0`	fixed
Alpine	botan3	3.22	`3.5.0-r0`	fixed
Alpine	botan3	3.23	`3.5.0-r0`	fixed
Alpine	botan3	3.24	`3.5.0-r0`	fixed
Ubuntu	botan	18.04	`2.4.0-3`	vulnerable
Ubuntu	botan	18.04	`2.4.0-4`	vulnerable
Ubuntu	botan	18.04	`2.4.0-5ubuntu1`	vulnerable
Ubuntu	botan	20.04	`2.9.0-2`	vulnerable
Ubuntu	botan	20.04	`2.9.0-2build1`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2`	vulnerable
Ubuntu	botan	20.04	`2.12.1-2build1`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu1`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2`	vulnerable
Ubuntu	botan	pro	`2.19.3+dfsg-1ubuntu2+esm1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	botan	source	trixie	`2.19.5+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	botan	source	bookworm	`2.19.3+dfsg-1+deb12u1`	not yet assigned	Not reported	Not reported
Ubuntu	botan	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-19	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-dev	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	libbotan-2-doc	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	python3-botan	deb	noble	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Alpine	botan	apk	3.17	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan	apk	3.18	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan	apk	3.19	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan	apk	3.20	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan	apk	3.21	`2.19.5-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan3	apk	3.21	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan3	apk	3.22	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan3	apk	3.23	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Alpine	botan3	apk	3.24	`3.5.0-r0`	Not reported	ALPINE-CVE-2024-39312	Not reported
Ubuntu	botan	deb	pro	`2.19.3+dfsg-1ubuntu2+esm1`	Not reported	UBUNTU-CVE-2024-39312	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[botan]Unknown
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · all · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
[python3-botan]Unknown
Source package: [botan]
Details (2)
- 2.19.3+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12
- 2.19.3+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 2.19.3+dfsg-1+deb12u1
  usn · botan · debian · bookworm; usn · botan · debian · 12

[Debian 13 (Trixie)]

[botan]Unknown
Source package: [botan3]
Details (4)
- 3.7.1+dfsg-2 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.7.1+dfsg-2 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 3.12.0+dfsg-2~deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-19]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-dev]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · amd64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · arm64 · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
[libbotan-2-doc]Unknown
Source package: [botan]
Details (2)
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13
- 2.19.5+dfsg-4 · all · trixie
  Fixed · Fixed: 2.19.5+dfsg-1
  usn · botan · debian · 13

Observed: Oct 27, 2026, 3:14:29 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]