wolfSSL 5.5.0 Session Resumption Denial Of Service Vulnerability

wolfSSL versions prior to 5.5.0 suffer from a denial of service condition related to session resumption. When a TLS 1.3 client connects to a wolfSSL server and SSLclear is called on its session, the server crashes with a segmentation fault. The bug occurs after a client performs a handshake again...

wolfSSL 5.3.0 Denial Of Service Vulnerability

In wolfSSL version 5.3.0, man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket above 256 bytes into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, the session cache...

wolfSSL 5.5.2 WOLFSSL_CALLBACKS Heap Buffer Over-Read Vulnerability

wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSLCALLBACKS ==================================================================== INFO ======= The CVE project has assigned the id CVE-2022-42905 to this issue. Severity: 9.1 CRITICAL Affected version: before 5.5.2 End of embargo: Ended October...

wolfssl:cryptofuzz-sp-math: Heap-buffer-overflow in sp_DhExp_NUMBER

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4802546512560128 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-sp-math Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

wolfSSL WOLFSSL_CALLBACKS Heap Buffer Over-Read

wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSLCALLBACKS ==================================================================== INFO ======= The CVE project has assigned the id CVE-2022-42905 to this issue. Severity: 9.1 CRITICAL Affected version: before 5.5.2 End of embargo: Ended October...

PT-2023-35640 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL affected versions not specified Description: The issue is related to a heap buffer overflow error. Technical details about the error include a crash type of Heap-buffer-overflow WRITE 16. The crash state involves the wc AesCbcEncrypt...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in AesGcmCryptUpdate_C

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6020772311465984 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_AesFeedbackEncrypt

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6006292768751616 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_AesCbcEncrypt

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4637109640364032 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash...

The vulnerability of the SSL/TLS WolfSSL library lies in its ability to read data beyond the buffer boundaries in memory. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the SSL/TLS library WolfSSL is related to the ability to read data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information or cause service failures through the...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in DesProcessBlock

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6246973621796864 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash...

wolfssl:fuzzer-wolfssl-ocsp: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5864925224632320 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-ocsp Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

wolfssl:fuzzer-wolfssl-x509: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4676414156963840 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-x509 Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

MariaDB 5.5.0 < 5.5.53 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 5.5.53. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.53 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client mysqldump. Supported versions that are affected a...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_AesFeedbackCFB1

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6221136778362880 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...

Buffer Over Read

wolfSSL is vulnerable to buffer overreads. The vulnerability exists if callback functions are enabled via the WOLFSSLCALLBACKS flag which allows an attacker to trigger a buffer over-read on the heap of 5 bytes...

wolfssl:cryptofuzz-sp-math: Use-of-uninitialized-value in wc_DhAgree

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4945819606581248 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow if callback functions are enabled via the WOLFSSLCALLBACKS flag. A malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. Note: WOLFSSLCALLBACKS is only intended fo...

CVE-2022-42905

In wolfSSL before 5.5.2, if callback functions are enabled via the WOLFSSLCALLBACKS flag, then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. WOLFSSLCALLBACKS is only intended for debugging...

DEBIAN-CVE-2022-42905

In wolfSSL before 5.5.2, if callback functions are enabled via the WOLFSSLCALLBACKS flag, then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. WOLFSSLCALLBACKS is only intended for debugging...