CVE-2018-9127 - CVE House
Back to Database
Status published Critical CVE-2018-9127

Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard...

Vulnerability Description

Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9127

Credits & Attribution

No credits recorded in the NVD database.

References

More from botan project

View All →
CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP...
Unknown 0
CVE-2021-40529
The ElGamal implementation in Botan through 2.18.1, as used in...
Medium 5.9
CVE-2021-24115
In Botan before 2.17.3, constant-time computations are not used for...
Critical 9.8
CVE-2018-9860
An issue was discovered in Botan 1.11.32 through 2.x before...
High 7.5
CVE-2018-20187
A side-channel issue was discovered in Botan before 2.9.0. An...
Medium 5.9

Affected Vendor

botan project

View all reports →

Affected Software

botan
Vulnerable Versions:
2.2.0

Timeline

Official Publish: April 2nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.