CVE-2024-34702
📋 TL;DR
This vulnerability in the Botan cryptography library allows denial-of-service attacks via quadratic complexity in X.509 certificate name constraint validation. Attackers can craft certificate chains with many SubjectAlternativeNames and name constraints to cause excessive CPU consumption. Systems using Botan for X.509 certificate processing are affected.
💻 Affected Systems
- Botan cryptography library
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all services relying on Botan for certificate validation.
Likely Case
Degraded performance or temporary service disruption during certificate validation of malicious chains.
If Mitigated
Minimal impact with proper rate limiting, input validation, and updated Botan versions.
🎯 Exploit Status
Exploitation requires crafting specific certificate chains with many names and constraints, which is non-trivial but documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Botan 3.5.0 or 2.19.5
Vendor Advisory: https://github.com/randombit/botan/security/advisories
Restart Required: Yes
Instructions:
1. Update Botan to version 3.5.0 or 2.19.5. 2. Recompile applications using Botan. 3. Restart affected services.
🔧 Temporary Workarounds
Limit certificate chain complexity
allConfigure applications to reject certificates with excessive SubjectAlternativeNames or name constraints
Application-specific configuration required
Rate limit certificate validation
allImplement rate limiting on certificate validation endpoints
Application/network-specific configuration required
🧯 If You Can't Patch
- Implement strict input validation to reject certificates with unusually large numbers of names or constraints
- Deploy network-level protections like WAFs to filter malicious certificate traffic
🔍 How to Verify
Check if Vulnerable:
Check Botan version: botan version or check linked library versionCheck Version:
botan version 2>&1 | grep -i versionVerify Fix Applied:
Verify Botan version is 3.5.0+ or 2.19.5+📡 Detection & Monitoring
Log Indicators:
- High CPU usage during certificate validation
- Certificate validation timeouts
- Unusually large certificate chains in logs
Network Indicators:
- Incoming connections presenting large certificate chains
- Increased TLS handshake failures
SIEM Query:
source="application_logs" AND ("certificate validation" OR "X.509") AND ("timeout" OR "high cpu" OR "denial")🔗 References
- https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
- https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
- https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
- https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
- https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
- https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
- https://github.com/randombit/botan/pull/4034
- https://github.com/randombit/botan/pull/4045
- https://github.com/randombit/botan/pull/4047
- https://github.com/randombit/botan/pull/4052
- https://github.com/randombit/botan/pull/4186
- https://github.com/randombit/botan/pull/4187
- https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j
- https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e
- https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac
- https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
- https://github.com/randombit/botan/commit/7606d70d3a2ac7114476ec2651ca0243c4536fdf
- https://github.com/randombit/botan/commit/c3264821b9f6286ee4e6e3e06826f6b7177e6d41
- https://github.com/randombit/botan/commit/ff704b12e6fa351aaedd07bffdc91722e84586b8
- https://github.com/randombit/botan/pull/4034
- https://github.com/randombit/botan/pull/4045
- https://github.com/randombit/botan/pull/4047
- https://github.com/randombit/botan/pull/4052
- https://github.com/randombit/botan/pull/4186
- https://github.com/randombit/botan/pull/4187
- https://github.com/randombit/botan/security/advisories/GHSA-5gg9-hqpr-r58j
