CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

CVE-2022-25638

In wolfSSL, pre-5.2.0 versions are affected: during a TLS 1.3 handshake, if the sig_algo field differs between the certificate_verify and certificate messages, certificate validation may be bypassed, enabling potential authentication bypass. Affected product: wolfSSL library (versions before 5.2....

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

Wolfssl 信任管理问题漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, USA. A trust management issue vulnerability exists in wolfSSL versions prior to 5.2.0, which stems from the inability of TLS 1.3 servers to properly enforce mutual...

CVE-2022-25640: Improper Certificate Validation

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

wolfSSL 信任管理问题漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from Wolfssl, Inc. in the United States. A security vulnerability exists in wolfSSL versions prior to 5.2.0, which stems from an application attempting to authenticate a TLS 1.3 client to a...

PT-2022-17425 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.2.0 Description: The issue allows certificate validation to be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig algo field differs between the certificate...

PT-2022-17427 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.2.0 Description: The issue concerns a TLS 1.3 server that cannot properly enforce mutual authentication. A client can omit the certificate verify message from the handshake and never present a certificate...

CVE-2022-25638: Improper Certificate Validation

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

wolfssl:fuzzer-wolfssl-x509: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5291768931811328 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-x509 Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wolfssl:fuzzer-wolfssl-x509: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6233113225723904 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-x509 Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

wolfssl:cryptofuzz-sp-math-all: Index-out-of-bounds in sp_mul

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6301105007493120 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math-all Job Type: libfuzzerubsanwolfssl Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Cras...

wolfSSL security feature issue vulnerability

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded system developers from Wolfssl USA. wolfSSL has a security vulnerability that stems from the use of non-random IV values for x prior to 5.1.1 under certain circumstances. This affects AES-CBC or DES3...