CVE-2017-2801: botan_project botan Out-of-bounds Read
Vulnerability summary
CVE-2017-2801 is a critical (CVSS 9.8) Out-of-bounds Read vulnerability in botan_project botan. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 24-05-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA6.5MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
+0.15 pp
From 1.17% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Botan_project1 product
- botan2.0.1
Debian1 product
- botan1.10< 1.10.8-2+deb8u2 | < 1.10.5-1+deb7u3
Mageia1 product
- botan< 1.10.14-5.1.mga6
Randombit1 product
- botan2.0.1
Ubuntu1 product
- botan1.10< 1.10.5-1+deb7u1ubuntu0.14.04.1+esm1 | All versions (No fix recorded)
5 vendors · 5 products
References
10 links
- talosintelligence.com/vulnerability_reports/TALOS-2017-0294X Refsource MISCExploitMitigationThird Party AdvisoryVDB Entry