CVE-2026-32883
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
概要
Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Botan is a C++ cryptography library. From version 3.0.0 to before version 3.11.0, during X509 path validation, OCSP responses were checked for an appropriate status code, but critically omitted verifying the signature of the OCSP response itself. This issue has been patched in version 3.11.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2026-32883 botan3 修正版: 3.11.0-r0
- Debian DEBIAN-CVE-2026-32883 botan3 修正版: 3.11.0+dfsg-2
- Ubuntu UBUNTU-CVE-2026-32883 botan1.10
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov