CVE-2023-3724 TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

CVE-2023-3724 TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

wolfSSL 信任管理问题漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library for embedded systems developers from WolfSSL, Inc. in the United States. A security vulnerability exists in WolfSSL versions prior to 5.6.2 that stems from a security issue with TLS 1.3 sessions that allows an eavesdropper to...

PT-2023-25848

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description When a TLS 1.3 client connects to a malicious server without receiving a PSK pre shared key extension or a KSE key share extension, it uses a default predictable buffer for the IKM Input Keyi...

CVE-2023-3724: Improper Input Validation

If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connecting to a malicious server, a default predictable buffer gets used for the IKM Input Keying Material value when generating the session master secret. Using a potentially known IKM value when...

wolfssl:fuzzer-wolfssh-client-randomize: Use-of-uninitialized-value in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6443666340970496 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssl-server-randomize: Use-of-uninitialized-value in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5869516822544384 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssh-client-randomize: Heap-buffer-overflow in BundlePacket

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6341560443469824 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 9...

wolfssl:fuzzer-wolfssl-client-randomize: Heap-buffer-overflow in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5182059688886272 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ...

PT-2023-35804 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL affected versions not specified Description: The issue is related to a heap-double-free crash. Technical details about the crash include the wolfCrypt custom free and wolfSSL Free functions, as well as the FreeOcspRequest function...

wolfssl:fuzzer-wolfssl-client-randomize: Heap-double-free in wolfCrypt_custom_free

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5457896212398080 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-double-free Crash Address:...

wolfssl:cryptofuzz-normal-math: Heap-buffer-overflow in sp_read_unsigned_bin

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4522678383149056 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-normal-math Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash...

Siemens SCALANCE W1750D Cryptographic Issues (CVE-2017-13099)

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as ROBOT. This plugin only works with Tenable.ot...

wolfssl:cryptofuzz-fastmath: Index-out-of-bounds in fp_mod_2d

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5989843628064768 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-fastmath Job Type: libfuzzerubsanwolfssl Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

wolfssl:fuzzer-wolfssl-server-randomize: Use-of-uninitialized-value in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5401296500031488 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssl-client: Heap-buffer-overflow in GetDateInfo

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4914558627348480 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address...

wolfssl:fuzzer-wolfssl-x509: Heap-buffer-overflow in ParseCertRelative

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5272339217776640 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-x509 Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wolfssl:fuzzer-wolfssl-client-randomize: Heap-buffer-overflow in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6249726027890688 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

wolfssl:fuzzer-wolfssl-crl: Heap-buffer-overflow in ParseCRL

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6402214295109632 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-crl Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...