wolfssl:fuzzer-wolfssl-rsa: Use-of-uninitialized-value in RsaMGF

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6330398860247040 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-rsa Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

wolfCrypt leaks cryptographic information via timing side channel

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...

wolfssl:cryptofuzz-sp-math-all: Heap-buffer-overflow in sp_copy

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6752271565717504 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math-all Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass during attempted authentication by a TLS 1.3 client to a TLS 1.3 server, certificate validation may be bypassed when the sigalgo field differs between the certificateverify message and the certificate message...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass because a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate. Remediation...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

DEBIAN-CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

DEBIAN-CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

Input validation

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

UBUNTU-CVE-2022-25638

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message...

UBUNTU-CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

CVE-2022-25640 affects wolfSSL prior to 5.2.0 where a TLS 1.3 server cannot properly enforce mutual authentication; a client can omit certificate_verify and avoid presenting a certificate. Impact described across sources as enabling bypass of mutual auth during TLS 1.3 handshakes. Affected compon...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25638

In wolfSSL, pre-5.2.0 versions are affected: during a TLS 1.3 handshake, if the sig_algo field differs between the certificate_verify and certificate messages, certificate validation may be bypassed, enabling potential authentication bypass. Affected product: wolfSSL library (versions before 5.2....