CVE-2017-2801
Publication date 24 May 2017
Last updated 18 August 2025
Ubuntu priority
A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.
From the Ubuntu Security Team
It was discovered that Botan did not properly manage x509 DN strings comparisons when provided with a specially crafted X509 certificate. An attacker could possibly use this issue to cause out of bound reads, resulting in information leakage, denial of service, or potentially incorrect certificate validation results.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| botan1.10 | 25.04 plucky | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty |
Fixed 1.10.5-1+deb7u1ubuntu0.14.04.1+esm1
|
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.5 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | Low |
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |