CVE-2015-7826: Critical severity botan vulnerability
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting .example.com as a match for bar.foo.example.com.
Other sources
RFC 6125 specifies how to match a X.509v3 certificate against a DNS name for application usage.
Otherwise valid certificates using wildcards would be accepted as matching certain hostnames they should not according to RFC 6125. For example a certificate issued for ‘.example.com’ should match ‘foo.example.com’ but not ‘example.com’ or ‘bar.foo.example.com’. Previously Botan would accept such a certificate as valid for ‘bar.foo.example.com’.
RFC 6125 also requires that when matching a X.509 certificate against a DNS name, the CN entry is only compared if no subjectAlternativeName entry is available. Previously X509Certificate::matchesdnsname would always check both names.
External references:
http://botan.randombit.net/security.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7826?
CVE-2015-7826 has a medium severity due to improper handling of wildcard matching against hostnames.
How do I fix CVE-2015-7826?
To mitigate CVE-2015-7826, update Botan to version 1.11.22 or later.
What versions of Botan are affected by CVE-2015-7826?
Botan versions prior to 1.11.22, specifically up to version 1.11.21, are affected by CVE-2015-7826.
What type of attacks does CVE-2015-7826 enable?
CVE-2015-7826 may allow remote attackers to exploit improper wildcard certificate validation.
What is the impact of CVE-2015-7826 on X.509 certificate validation?
CVE-2015-7826 can lead to security vulnerabilities in X.509 certificate validation by accepting incorrect hostname matches.