REDHAT-BUG-2456285: High severity Botan Botan vulnerability
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
botanto a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456285?
The severity of REDHAT-BUG-2456285 is high with a score of 7.
How do I fix REDHAT-BUG-2456285?
To fix REDHAT-BUG-2456285, upgrade Botan to version 3.11.1 or later.
What vulnerabilities does REDHAT-BUG-2456285 introduce?
REDHAT-BUG-2456285 allows a client to bypass server-enforced authentication by processing ApplicationData records before the Finished message in TLS 1.3 implementation.
Which software is affected by REDHAT-BUG-2456285?
The vulnerability REDHAT-BUG-2456285 affects the Botan cryptography library prior to version 3.11.1.
Can REDHAT-BUG-2456285 lead to unauthorized access?
Yes, REDHAT-BUG-2456285 can lead to unauthorized access by allowing a client to bypass authentication mechanisms.