CVE-2017-2801

Name: CVE-2017-2801
Creator: NVD / NIST
Published: 2017-05-24T14:29:00.537+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.32%

Last modified Jun 17, 2026

CVE-2017-2801 is a vulnerability of currently unknown severity. A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.. EPSS estimates a 1.32% chance of exploitation in the next 30 days.

Description

A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to trigger this vulnerability.

Metrics

EPSS Probability

1.32%

67.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

Affected Software

Vendor	Product	Versions
Botan Project	Botan	2.0.1

References

http://talosintelligence.com/vulnerability_reports/TALOS-2017-0294Exploit, Mitigation, Third Party Advisory, VDB Entry
http://www.debian.org/security/2017/dsa-3939
http://www.securityfocus.com/bid/98106Third Party Advisory, US Government Resource
http://talosintelligence.com/vulnerability_reports/TALOS-2017-0294Exploit, Mitigation, Third Party Advisory, VDB Entry
http://www.debian.org/security/2017/dsa-3939
http://www.securityfocus.com/bid/98106Third Party Advisory, US Government Resource

Timeline

Published: May 24, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-2801?

How severe is CVE-2017-2801?

Severity scoring for CVE-2017-2801 is pending analysis. The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.

How do I fix CVE-2017-2801?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-2801?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST