CVE-2024-34703 Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters
An attacker can cause denial of service in Botan by presenting an X.509 certificate with excessively large elliptic curve parameters, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34703?
CVE-2024-34703 is a high-severity denial of service vulnerability in randombit botan, published on 30 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.
Which versions are affected by CVE-2024-34703?
Linux distribution packages (7)
MozillaThunderbird SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird SUSE:Linux Enterprise Workstation Extension 15 SP5 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird SUSE:Linux Enterprise Workstation Extension 15 SP6 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird openSUSE:Leap 15.5 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird openSUSE:Leap 15.6 | All versions | 115.12.2-150200.8.168.1 |
MozillaThunderbird openSUSE:Tumbleweed | All versions | 115.12.2-1.1 |
How do I fix CVE-2024-34703?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-34703 being exploited?
There is no known exploitation of CVE-2024-34703 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-34703, AZL-43708, AZL-44214, DEBIAN-CVE-2024-34703, GHSA-w4g2-7m2h-7xj7, MGASA-2024-0297 and 3 more.