Patched vulnerability in Botan library allows excessive computation for ECDSA X.509 certificates

CVE-2024-34703

What is CVE-2024-34703?

The Botan C++ cryptography library is susceptible to a vulnerability that arises from improper handling of ECDSA X.509 certificates featuring explicit encoding of parameters. Attackers could exploit this flaw by using excessively large parameters, leading to an increase in computational load during the parsing process. The flaw existed in versions of Botan prior to 3.3.0 and 2.19.4, which allowed for the use of prime parameters of considerable size; in one proof-of-concept, a 16Kbit prime was effectively utilized. The vulnerability has since been addressed, limiting the permissible size of elliptic curve prime parameters to a maximum of 521 bits in the updated versions. Given the deprecation of support for explicit encoding of elliptic curve parameters, no workaround is officially provided.

References