{
  "cveId": "CVE-2024-34702",
  "url": "https://patchblox.com/security/cve/CVE-2024-34702",
  "summary": "CVE-2024-34702 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2024-34702, released July 8, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "botan: Botan is a C\u002B\u002B cryptography library",
  "description": "Botan is a C\u002B\u002B cryptography library. X.509 certificates can identifyelliptic curves using either an object identifier or using explicitencoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking nameconstraints in X.509 certificates is quadratic in the number of names andname constraints. An attacker who presented a certificate chain whichcontained a very large number of names in the SubjectAlternativeName,signed by a CA certificate which contained a large number of nameconstraints, could cause a denial of service. The problem has beenaddressed in Botan 3.5.0 and a partial backport has also been applied andis included in Botan 2.19.5.",
  "published": "2024-07-08T10:15:00Z",
  "severity": "Medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00845,
  "epssPercentile": 0.58265,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "botan",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.19.3\u002Bdfsg-1\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2024-34702",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-34702",
      "released": "2024-07-08T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "botan",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.19.5\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-34702",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-34702",
      "released": "2024-07-08T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "botan",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "fix": "botan 2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-botan-2.19.1-dfsg-2ubuntu1-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "botan",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "fix": "botan 2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-botan-2.19.3-dfsg-1ubuntu2-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "botan",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2.1",
      "fix": "botan 2.19.3\u002Bdfsg-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-botan-2.19.3-dfsg-1ubuntu2.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "libbotan-2-19",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "fix": "libbotan-2-19 2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libbotan-2-19-2.19.1-dfsg-2ubuntu1-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libbotan-2-19",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "fix": "libbotan-2-19 2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libbotan-2-19-2.19.3-dfsg-1ubuntu2-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libbotan-2-19",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2.1",
      "fix": "libbotan-2-19 2.19.3\u002Bdfsg-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libbotan-2-19-2.19.3-dfsg-1ubuntu2.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-botan",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "fix": "python3-botan 2.19.1\u002Bdfsg-2ubuntu1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-botan-2.19.1-dfsg-2ubuntu1-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-botan",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "fix": "python3-botan 2.19.3\u002Bdfsg-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-botan-2.19.3-dfsg-1ubuntu2-esm1",
      "released": "2024-10-23T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-botan",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.19.3\u002Bdfsg-1ubuntu2.1",
      "fix": "python3-botan 2.19.3\u002Bdfsg-1ubuntu2.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-python3-botan-2.19.3-dfsg-1ubuntu2.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}