CVSS: 9.4EPSS: 3%CPEs: 1EXPL: 1CVE-2022-42905 – wolfSSL WOLFSSL_CALLBACKS Heap Buffer Over-Read
https://notcve.org/view.php?id=CVE-2022-42905
06 Nov 2022 — In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.) En wolfSSL anterior a 5.5.2, si las funciones callback están habilitadas (a través del indicador WOLFSSL_CALLBACKS), entonces un cliente TLS 1.3 malicioso o un atacante de red puede desencadenar una sobrelectura del búfer de memoria de 5 bytes. (WOLFSSL_CALLBA... • https://packetstorm.news/files/id/170610 • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42961
https://notcve.org/view.php?id=CVE-2022-42961
15 Oct 2022 — An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via an advanced technique for ECDSA key recovery. (In 5.5.0 and later, WOLFSSL_CHECK_SIG_FAULTS can be used to address the vulnerability.) • https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 2CVE-2022-39173 – wolfSSL Buffer Overflow
https://notcve.org/view.php?id=CVE-2022-39173
29 Sep 2022 — In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message. • https://packetstorm.news/files/id/169600 • CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-44718
https://notcve.org/view.php?id=CVE-2021-44718
02 Sep 2022 — wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers. wolfSSL versiones hasta 5.0.0, permite a un atacante causar una denegación de servicio y un bucle infinito en el componente cliente mediante el envío de tráfico diseñado desde una posición de tipo Machine-in-the-Middle (M... • https://github.com/wolfSSL/wolfssl/releases • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 3%CPEs: 1EXPL: 3CVE-2022-38152 – wolfSSL Session Resumption Denial of Service
https://notcve.org/view.php?id=CVE-2022-38152
31 Aug 2022 — An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. No... • http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.9EPSS: 2%CPEs: 1EXPL: 3CVE-2022-38153 – wolfSSL 5.3.0 Denial of Service
https://notcve.org/view.php?id=CVE-2022-38153
31 Aug 2022 — An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. Man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket (more than 256 bytes) into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, the session cache frees a pointer that points to unallocated memory, causing the client to crash with a "free(): invalid p... • http://packetstormsecurity.com/files/170605/wolfSSL-5.3.0-Denial-Of-Service.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34293
https://notcve.org/view.php?id=CVE-2022-34293
08 Aug 2022 — wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped. wolfSSL versiones anteriores a 5.4.0, permite a atacantes remotos causar una denegación de servicio por medio de DTLS porque puede omitirse una comprobación de retorno de ruta • http://www.openwall.com/lists/oss-security/2022/08/08/6 •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2022-25640
https://notcve.org/view.php?id=CVE-2022-25640
24 Feb 2022 — In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate. En wolfSSL versiones anteriores a 5.2.0, un servidor TLS versión 1.3 no puede aplicar correctamente el requisito de autenticación mutua. Un cliente puede simplemente omitir el mensaje certificate_verify del handshake, y nunca presentar un certificado • https://github.com/dim0x69/cve-2022-25640-exploit • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25638
https://notcve.org/view.php?id=CVE-2022-25638
24 Feb 2022 — In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message. En wolfSSL versiones anteriores a 5.2.0, una comprobación del certificado puede ser omitida durante el intento de autenticación por parte de un cliente TLS versión 1.3 a un servidor TLS versión 1.3. Esto ocurre cuando el campo sig_algo difiere entre el mensaje ce... • https://github.com/wolfSSL/wolfssl/pull/4813 • CWE-295: Improper Certificate Validation •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23408
https://notcve.org/view.php?id=CVE-2022-23408
18 Jan 2022 — wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c. wolfSSL versiones 5.x anteriores a 5.1.1, usa valores IV no aleatorios en determinadas situaciones. Esto afecta a las conexiones (sin AEAD) que usan AES-CBC o DES3 con TLS versiones 1.1 o 1.2 o DTLS versiones 1.1 o 1.2. Esto ocurre debido a una inici... • https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-511-jan-3rd-2022 • CWE-330: Use of Insufficiently Random Values •