wolfssl:fuzzer-wolfssh-client: Stack-buffer-overflow in fp_read_unsigned_bin

Detailed Report: https://oss-fuzz.com/testcase?key=5702057176334336 Project: wolfssl Fuzzing Engine: afl Fuzz Target: fuzzer-wolfssh-client Job Type: aflasanwolfssl Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address: 0x7ffda2039cb8 Crash State: fpreadunsignedbin...

wolfssl:fuzzer-wolfssl-client-randomize: Use-of-uninitialized-value in memory_test

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5679816023736320 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssh-server-randomize: Heap-buffer-overflow in wolfSSH_CleanPath

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4901641429712896 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 16...

wolfssl:fuzzer-wolfssh-server: Heap-buffer-overflow in wolfSSH_accept

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5653493769306112 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address...

wolfssl:fuzzer-wolfssl-client-randomize: Use-of-uninitialized-value in memory_test

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5721325144113152 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssl-rsa: Heap-buffer-overflow in RsaPad_PSS

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5717341540974592 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-rsa Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

wolfssl:fuzzer-wolfssh-server: Heap-buffer-overflow in clean_path

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6046775766679552 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: fuzzer-wolfssh-server Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

wolfssl:fuzzer-wolfssh-server: Heap-buffer-overflow in wolfSSH_accept

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5752343091740672 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address...

wolfssl:fuzzer-wolfssl-server-randomize: Heap-buffer-overflow in fp_to_unsigned_bin_at_pos

Detailed Report: https://oss-fuzz.com/testcase?key=5123165615030272 Project: wolfssl Fuzzing Engine: afl Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: aflasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x602000001040 Crash State: fptounsignedbinatpo...

PT-2020-22061

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description The issue is related to a crash in wolfSSL, specifically in the GetDhPublicKey function, which is called after wolfSSL Free and wolfCrypt custom free. This crash is of type UNKNOWN WRITE...

wolfssl:fuzzer-wolfssl-server: Crash in wolfCrypt_custom_free

Detailed Report: https://oss-fuzz.com/testcase?key=5171589131534336 Project: wolfssl Fuzzing Engine: afl Fuzz Target: fuzzer-wolfssl-server Job Type: aflasanwolfssl Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000000788e50 Crash State: wolfCryptcustomfree wolfSSLFree GetDhPublicK...

wolfssl:fuzzer-wolfssl-rsa: Index-out-of-bounds in fp_read_radix_16

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4899197473783808 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-rsa Job Type: libfuzzerubsanwolfssl Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

wolfssl:fuzzer-wolfssh-server: Heap-buffer-overflow in SendUserAuthPkOk

Detailed Report: https://oss-fuzz.com/testcase?key=4871081842966528 Project: wolfssl Fuzzing Engine: afl Fuzz Target: fuzzer-wolfssh-server Job Type: aflasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x61100000013f Crash State: SendUserAuthPkOk...

wolfSSL Denial of Service Vulnerability (CNVD-2020-50284)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 4.5.0, which can be exploited by an attacker to send a constructed...

wolfSSL Information Disclosure Vulnerability (CNVD-2020-49929)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. An information disclosure vulnerability exists in wolfSSL versions prior to 4.5.0. The vulnerability is related to a buggy implementatio...

CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...

CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...

DEBIAN-CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...

Code injection

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...

CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...