GCVE - cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:botan_project:botan:1.11.13:*:*:*:*:*:*:*

part: a version: 1.11.13 update: *

Vendor	Botan Project (`dcc7246a-4139-5e79-a769-26d757af793e`)
Product	Botan (`24d72b39-c9aa-545e-89f4-0ca3ab3e0aa6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/botan`	purl2cpe	2026-06-01 10:13:20.444412
`pkg:deb/ubuntu/botan`	purl2cpe	2026-06-01 10:13:20.444413
`pkg:github/randombit/botan`	purl2cpe	2026-06-01 10:13:20.444414
`pkg:rpm/fedora/botan`	purl2cpe	2026-06-01 10:13:20.444416
`pkg:rpm/opensuse/botan`	purl2cpe	2026-06-01 10:13:20.444417

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14737`	vulnerable	2026-06-08 05:08:57.378886	Details available A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key. Published: 2017-09-26T01:00:00.000Z Updated: 2024-08-05T19:34:39.919Z Open on db.gcve.eu Reference links https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai https://github.com/randombit/botan/issues/1222 https://lists.debian.org/debian-lts-announce/2021/11/msg00006.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9132`	vulnerable	2026-06-08 05:08:22.678764	Details available In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure. Published: 2017-01-30T22:00:00.000Z Updated: 2024-08-06T02:42:10.498Z Open on db.gcve.eu Reference links https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/ https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f http://www.securityfocus.com/bid/95879 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6879`	vulnerable	2026-06-08 05:08:11.314786	Details available The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value. Published: 2017-04-10T15:00:00.000Z Updated: 2024-08-06T01:43:38.433Z Open on db.gcve.eu Reference links https://botan.randombit.net/security.html#id2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2850`	vulnerable	2026-06-08 05:07:43.466333	Details available Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors. Published: 2016-05-13T14:00:00.000Z Updated: 2024-08-05T23:32:21.226Z Open on db.gcve.eu Reference links http://marc.info/?l=botan-devel&m=145852488622892&w=2 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html https://security.gentoo.org/glsa/201701-23 http://botan.randombit.net/security.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2849`	vulnerable	2026-06-08 05:07:43.458063	Details available Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack. Published: 2016-05-13T14:00:00.000Z Updated: 2024-08-05T23:32:21.324Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183669.html http://www.debian.org/security/2016/dsa-3565 http://marc.info/?l=botan-devel&m=146185420505943&w=2 https://security.gentoo.org/glsa/201701-23 http://botan.randombit.net/security.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2196`	vulnerable	2026-06-08 05:07:33.597490	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2195`	vulnerable	2026-06-08 05:07:33.596591	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2194`	vulnerable	2026-06-08 05:07:33.589522	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7827`	vulnerable	2026-06-08 05:07:02.015068	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5727`	vulnerable	2026-06-08 05:06:50.839392	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5726`	vulnerable	2026-06-08 05:06:50.835919	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Botan 1.11.13

Notes

PURL mappings

Vulnerability references

Contribute