CVE-2019-19960

The CVE-2019-19960 issue affects wolfSSL prior to 4.3.0 where wc_ecc_mulmod_ex does not properly resist side-channel attacks. This is described across multiple sources (e.g., NVD entry; wolfSSL 4.3.0-stable release). The vulnerability impacts confidentiality (as indicated by CVSS 3.1: MEDIUM, bas...

CVE-2019-19960

In wolfSSL before 4.3.0, wceccmulmodex does not properly resist side-channel attacks...

CVE-2019-19962

wolfSSL before 4.3.0 mishandles calls to wcSignatureGenerateHash, leading to fault injection in RSA cryptography...

CVE-2019-19962

CVE-2019-19962 affects wolfSSL older than 4.3.0. The vulnerability arises from mishandling calls to wc_SignatureGenerateHash, enabling fault injection in RSA cryptography. Impact per sources is confined to information in the provided documents; no exploitation details are given beyond fault injec...

CVE-2019-19962

wolfSSL before 4.3.0 mishandles calls to wcSignatureGenerateHash, leading to fault injection in RSA cryptography...

CVE-2019-19962

wolfSSL before 4.3.0 mishandles calls to wcSignatureGenerateHash, leading to fault injection in RSA cryptography...

CVE-2019-19963

An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce...

CVE-2019-19963

wolfSSL before 4.3.0 in a non-default configuration with DSA enabled is vulnerable. DSA signing uses the BEEA algorithm during nonce modular inversion, enabling a side-channel attack on the nonce. Affected: wolfSSL prior to 4.3.0 (non-default DSA). Remediation: upgrade to 4.3.0-stable (or apply v...

CVE-2019-19963

An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce...

CVE-2019-19963

An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce...

PT-2019-16024

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0 Description An issue was discovered in a non-default configuration where DSA is enabled, allowing a side-channel attack against the nonce due to the use of the BEEA algorithm during modular inversion of the nonc...

Unspecified vulnerability in wolfSSL (CNVD-2020-01645)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 4.3.0, which can be exploited by an attacker to perform a side-channel atta...

PT-2019-16022

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0 Description The issue is related to the wc ecc mulmod ex function, which does not properly resist side-channel attacks. Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve th...

CVE-2019-19963: Undefined Security Weakness

An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce...

PT-2019-16023

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0 Description The issue is related to the mishandling of calls to the wc SignatureGenerateHash function, which can lead to fault injection in RSA cryptography. Recommendations For versions prior to 4.3.0, update t...

Unspecified vulnerability in wolfSSL (CNVD-2020-01644)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in the 'wceccmulmodex' function in wolfSSL versions prior to 4.3.0, which can be exploited by an attacke...

CVE-2019-19962: Improper Verification of Cryptographic Signature

wolfSSL before 4.3.0 mishandles calls to wcSignatureGenerateHash, leading to fault injection in RSA cryptography...

CVE-2019-19960: Undefined Security Weakness

In wolfSSL before 4.3.0, wceccmulmodex does not properly resist side-channel attacks...

DEBIAN-CVE-2019-14317

wolfSSL and wolfCrypt 4.1.0 and earlier formerly known as CyaSSL generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces...

CVE-2019-14317

wolfSSL and wolfCrypt 4.1.0 and earlier formerly known as CyaSSL generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces...