Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wolfssl vulnerabilities and exploits
(subscribe to this query)
5.3
CVSSv3
CVE-2020-11735
The private-key operations in ecc.c in wolfSSL prior to 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."
Wolfssl Wolfssl
9.8
CVSSv3
CVE-2019-6439
examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL up to and including 3.15.7 has a heap-based buffer overflow.
Wolfssl Wolfssl
2 Github repositories
5.5
CVSSv3
CVE-2017-6076
In versions of wolfSSL prior to 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine.
Wolfssl Wolfssl
7.5
CVSSv3
CVE-2019-19962
wolfSSL prior to 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.
Wolfssl Wolfssl
1 Github repository
9.8
CVSSv3
CVE-2017-2800
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL up to and including 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, ...
Wolfssl Wolfssl
1 EDB exploit
8.1
CVSSv3
CVE-2021-3336
DoTls13CertificateVerify in tls13.c in wolfSSL prior to 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers ca...
Wolfssl Wolfssl
7 Github repositories
8.8
CVSSv3
CVE-2023-3724
If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially...
Wolfssl Wolfssl
9.8
CVSSv3
CVE-2021-37155
wolfSSL 4.6.x up to and including 4.7.x prior to 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response.
Wolfssl Wolfssl
1 Github repository
9.8
CVSSv3
CVE-2014-2896
The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL prior to 2.9.4 allows remote malicious users to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read.
Wolfssl Wolfssl
9.8
CVSSv3
CVE-2014-2897
The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 prior to 2.9.4 does not check the padding length when verification fails, which allows remote malicious users to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read.
Wolfssl Wolfssl
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
NEXT »