wolfssl:fuzzer-wolfssl-rsa: Use-of-uninitialized-value in sp_div

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6203444223672320 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-rsa Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

wolfssl:fuzzer-wolfssl-server-randomize: Use-of-uninitialized-value in fuzzer_send

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6043368343076864 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-server-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

wolfssl:fuzzer-wolfssl-ocsp: Heap-buffer-overflow in DecodeBasicOcspResponse

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4536341141782528 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-ocsp Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

K15622: wolfSSL CyaSSL vulnerability CVE-2013-1623

Security Advisory Description The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks...

SUSE CVE-2013-1623

The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks...

SUSE CVE-2016-7440

The C software implementation of AES Encryption and Decryption in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences...

SUSE CVE-2017-13099

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."...

wolfssl:cryptofuzz-sp-math-all: Use-of-uninitialized-value in (is_trivial_cpp_int<boost::multiprecision::backends::cpp_int_backend<0u,

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5020059606319104 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math-all Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

wolfssl:cryptofuzz-disable-fastmath: Heap-buffer-overflow in sp_div_2

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6486962023563264 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-disable-fastmath Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Cra...

wolfssl:fuzzer-wolfssl-x509: Heap-buffer-overflow in GetASN_Items

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6252299078205440 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-x509 Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wolfssl:fuzzer-wolfssl-crl: Heap-buffer-overflow in GetASN_Items

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6059361144537088 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-crl Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wolfssl:cryptofuzz-fastmath: Heap-buffer-overflow in mp_to_unsigned_bin_len

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6372860513091584 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-fastmath Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_AesSetKeyLocal

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6004966759464960 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

wolfssl:cryptofuzz-disable-fastmath: Heap-buffer-overflow in sp_div_2

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5143233589280768 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-disable-fastmath Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

wolfssl:cryptofuzz-disable-fastmath: Use-of-uninitialized-value in (is_trivial_cpp_int<boost::multiprecision::backends::cpp_int_backend<0u,

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5765786372538368 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-disable-fastmath Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

wolfssl:cryptofuzz-sp-math: Use-of-uninitialized-value in sp_DhExp_NUMBER

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4674543652569088 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

wolfSSL 5.5.0 Session Resumption Denial Of Service Vulnerability

wolfSSL versions prior to 5.5.0 suffer from a denial of service condition related to session resumption. When a TLS 1.3 client connects to a wolfSSL server and SSLclear is called on its session, the server crashes with a segmentation fault. The bug occurs after a client performs a handshake again...

wolfSSL 5.5.2 WOLFSSL_CALLBACKS Heap Buffer Over-Read Vulnerability

wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSLCALLBACKS ==================================================================== INFO ======= The CVE project has assigned the id CVE-2022-42905 to this issue. Severity: 9.1 CRITICAL Affected version: before 5.5.2 End of embargo: Ended October...

wolfSSL 5.3.0 Denial Of Service Vulnerability

In wolfSSL version 5.3.0, man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket above 256 bytes into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, the session cache...

wolfssl:cryptofuzz-sp-math: Heap-buffer-overflow in sp_DhExp_NUMBER

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4802546512560128 Project: wolfssl Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-sp-math Job Type: honggfuzzasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...