Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Botan library on Fedora permits TLS downgrade attacks

CVE-2016-2850 · published 10 years ago
Summary

Versions of the Botan cryptography library up to 1.11.28 that are used in Fedora do not properly enforce rules for choosing signature algorithms and elliptic‑curve settings. This lets an attacker force a connection to use weaker encryption, which could expose transmitted data. Update Botan to version 1.11.29 or later to restore proper TLS protection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fedoraproject fedora 24
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
botan_project botan 1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.11.10
1.11.11
17 more version ranges
cpe:2.3:a:botan_project:botan:1.11.0:*:*:*:*:*:*:*
Original advisory text
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published13 May 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-2850 · NVD
Track software like this
Free during beta