Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wolfssl wolfssl vulnerabilities and exploits
(subscribe to this query)
5.5
CVSSv3
CVE-2016-7438
The C software implementation of ECC in wolfSSL (formerly CyaSSL) prior to 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences.
Wolfssl Wolfssl
5.5
CVSSv3
CVE-2016-7439
The C software implementation of RSA in wolfSSL (formerly CyaSSL) prior to 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences.
Wolfssl Wolfssl
5.3
CVSSv3
CVE-2019-14317
wolfSSL and wolfCrypt 4.1.0 and previous versions (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote malicious user to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bit...
Wolfssl Wolfssl
5.3
CVSSv3
CVE-2020-24585
An issue exists in the DTLS handshake implementation in wolfSSL prior to 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
Wolfssl Wolfssl
5.3
CVSSv3
CVE-2022-42961
An issue exists in wolfSSL prior to 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be pro...
Wolfssl Wolfssl
9.1
CVSSv3
CVE-2022-42905
In wolfSSL prior to 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)
Wolfssl Wolfssl
1 Github repository
4.7
CVSSv3
CVE-2019-13628
wolfSSL and wolfCrypt 4.0.0 and previous versions (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, ...
Wolfssl Wolfssl
9.8
CVSSv3
CVE-2014-2896
The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL prior to 2.9.4 allows remote malicious users to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.
Wolfssl Wolfssl
4.7
CVSSv3
CVE-2018-12436
wolfcrypt/src/ecc.c in wolfSSL prior to 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine...
Wolfssl Wolfssl
9.8
CVSSv3
CVE-2019-6439
examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL up to and including 3.15.7 has a heap-based buffer overflow.
Wolfssl Wolfssl
2 Github repositories
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-0044
client side
CVE-2021-47601
deserialization
CVE-2024-34994
encryption
CVE-2021-47609
CVE-2024-37079
CVE-2024-38608
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »