CVE-2015-5726

Botan before 1.11.22 improperly validates certificate paths, allowing remote attackers to cause a denial of service via a certificate with a loop in the certificate chain.

Botan versions 1.11.x before 1.11.22 are vulnerable to a padding-oracle attack that allows remote attackers to decrypt TLS ciphertext data using CBC ciphersuites.

Botan versions 1.11.x before 1.11.29 do not enforce TLS policy for signature algorithms and ECC curves, allowing remote attackers to conduct downgrade attacks.

Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, which might allow remote attackers to obtain ECDSA secret keys via a timing side-channel attack.

The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.

Botan before 1.10.13 and 1.11.x before 1.11.22 makes it easier for remote attackers to conduct million-message attacks by measuring time differences related to decoding of PKCS#1 padding.

The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.

The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, making it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group.

In Botan's TLS 1.3 implementation before version 3.11.1, ApplicationData records can be processed before the Finished message is received. This allows a client to bypass certificate-based authentication.

Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.