CVE-2018-9127: botan_project botan Improper Certificate Validation
Vulnerability summary
CVE-2018-9127 is a critical (CVSS 9.8) Improper Certificate Validation vulnerability in botan_project botan. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 02-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.07 pp
From 0.86% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- botan≥ 2.2.0, < 2.5.0-r0
Botan_project1 product
- botan≥ 2.2.0, ≤ 2.4.0
Debian1 product
- botan< 2.4.0-5
Ubuntu1 product
- botanAll versions (No fix recorded)
4 vendors · 4 products
