CVE-2016-2850: Input Validation
Published May 13, 2016
·Updated
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Affected Software
30 affected components
Fedoraproject Fedora=24
Botan Project Botan=1.11.0
Botan Project Botan=1.11.1
Botan Project Botan=1.11.2
Botan Project Botan=1.11.3
Botan Project Botan=1.11.4
Botan Project Botan=1.11.5
Botan Project Botan=1.11.6
Botan Project Botan=1.11.7
Botan Project Botan=1.11.8
Botan Project Botan=1.11.9
Botan Project Botan=1.11.10
Botan Project Botan=1.11.11
Botan Project Botan=1.11.12
Botan Project Botan=1.11.13
Botan Project Botan=1.11.14
Botan Project Botan=1.11.15
Botan Project Botan=1.11.16
Botan Project Botan=1.11.17
Botan Project Botan=1.11.18
Botan Project Botan=1.11.19
Botan Project Botan=1.11.20
Botan Project Botan=1.11.21
Botan Project Botan=1.11.22
Botan Project Botan=1.11.23
Botan Project Botan=1.11.24
Botan Project Botan=1.11.25
Botan Project Botan=1.11.26
Botan Project Botan=1.11.27
Botan Project Botan=1.11.28
Event History
May 13, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2850?
CVE-2016-2850 is classified as a medium-severity vulnerability.
2
How do I fix CVE-2016-2850?
To fix CVE-2016-2850, upgrade Botan to version 1.11.29 or later.
3
What versions of Botan are affected by CVE-2016-2850?
Botan versions from 1.11.0 to 1.11.28 are affected by CVE-2016-2850.
4
Can CVE-2016-2850 lead to compromise of sensitive data?
Yes, CVE-2016-2850 can potentially allow attackers to conduct downgrade attacks, which may lead to compromise of sensitive data.
5
Is CVE-2016-2850 related to TLS enforcement?
Yes, CVE-2016-2850 is related to the lack of TLS policy enforcement for signature algorithms and ECC curves.