CVE-2024-39312
개요
An authorization error flaw was found in the Botan cryptographic library. When parsing name constraint extensions, if the extension includes both permitted subtrees and excluded subtrees, only the permitted subtree is checked, leading to a name being permitted which is excluded by the subtree, resulting in loss of integrity.
내용
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
취약점 이해 (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
