CVE-2016-2850

Published: May 13, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

Affected (30)

Products: Fedoraproject: Fedora · Botan Project: Botan

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 24

Configuration B

29 vulnerable

Vulnerable Software	Affected Versions
Botan Project Botan	Version 1.11.0
Botan Project Botan	Version 1.11.10
Botan Project Botan	Version 1.11.11
Botan Project Botan	Version 1.11.12
Botan Project Botan	Version 1.11.13
Botan Project Botan	Version 1.11.14
Botan Project Botan	Version 1.11.15
Botan Project Botan	Version 1.11.16
Botan Project Botan	Version 1.11.17
Botan Project Botan	Version 1.11.18
Botan Project Botan	Version 1.11.19
Botan Project Botan	Version 1.11.1
Botan Project Botan	Version 1.11.20
Botan Project Botan	Version 1.11.21
Botan Project Botan	Version 1.11.22
Botan Project Botan	Version 1.11.23
Botan Project Botan	Version 1.11.24
Botan Project Botan	Version 1.11.25
Botan Project Botan	Version 1.11.26
Botan Project Botan	Version 1.11.27
Botan Project Botan	Version 1.11.28
Botan Project Botan	Version 1.11.2
Botan Project Botan	Version 1.11.3
Botan Project Botan	Version 1.11.4
Botan Project Botan	Version 1.11.5
Botan Project Botan	Version 1.11.6
Botan Project Botan	Version 1.11.7
Botan Project Botan	Version 1.11.8
Botan Project Botan	Version 1.11.9