Wolfssl Trust Management Issues Vulnerabilities

Wolfssl CyaSSL is the United States Wolfssl company for embedded systems developers to use a small, portable embedded SSL programming library. A trust management issue vulnerability exists in the DoTls13CertificateVerify function in the WolfSSL version 4.6.0 tls13.c file, which stems from not...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

CVE-2021-3336 affects wolfSSL (tls13.c: DoTls13CertificateVerify) prior to version 4.7.0, where processing is not ceased for certain anomalous peer behavior (signature types ED22519, ED448, ECC, or RSA) without the corresponding certificate. This can allow MITM attackers to impersonate TLS 1.3 se...

PT-2021-20128

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.7.0 Description The issue arises from the DoTls13CertificateVerify function in tls13.c, which does not properly handle anomalous peer behavior. Specifically, it continues processing when it receives an ED22519, ED44...

CVE-2021-3336: Improper Certificate Validation

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...