CVE-2022-39173

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...

CVE-2022-39173: Out-of-bounds Write

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...

CVE-2022-39173

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...

wolfssl:cryptofuzz-sp-math-all: Use-of-uninitialized-value in sp_div

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5748907007410176 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math-all Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

wolfssl:fuzzer-wolfssl-client-randomize: Heap-use-after-free in ProcessReplyEx

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5082775967629312 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-use-after-free READ 3 Cras...

Denial Of Service (DoS)

wolfSSL is vulnerable to denial of service. The vulnerability exists when client connects to a wolfSSL server and SSLclear due to improper session handling which allows an attacker to cause an application crash...

wolfssl:fuzzer-wolfssh-client: Heap-buffer-overflow in sp_forcezero

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6242178480865280 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Addres...

wolfssl:fuzzer-wolfssh-client: Use-of-uninitialized-value in wc_FreeRsaKey

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6086572889473024 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

wolfssl:fuzzer-wolfssh-client-randomize: Heap-buffer-overflow in ParseAndVerifyCert

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5451204620058624 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cra...

wolfssl:fuzzer-wolfssh-client-randomize: Heap-buffer-overflow in DoUserAuthRequest

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4970017363460096 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cra...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a possible infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. Details Denial of Service DoS describes a family of attacks, all aimed at making a syst...

wolfssl:fuzzer-wolfssl-rsa: Negative-size-param in wc_Sha3_256_Final

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4735758405074944 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-rsa Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash...

wolfssl:cryptofuzz-normal-math: Stack-buffer-overflow in wc_Shake256_Final

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5057208924110848 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Addres...

wolfssl:fuzzer-wolfssh-server-randomize: Use-of-uninitialized-value in sp_clear

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6364113307041792 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server-randomize Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

DEBIAN-CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

Code injection

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...

CVE-2021-44718

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...