NA

CVE-2023-6936

Published: 20/02/2024 Updated: 22/02/2024

Vulnerability Summary

In wolfSSL before 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging).

Vendor Advisories

Debian Bug report logs - #1059357 wolfssl: CVE-2023-6935 CVE-2023-6936 CVE-2023-6937 Package: src:wolfssl; Maintainer for src:wolfssl is Jacob Barthelmeh <sirkilamole@msncom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 23 Dec 2023 12:51:01 UTC Severity: important Tags: security, upstream Found ...

Github Repositories

This repository is a restructured copy of https://github.com/wolfSSL/wolfssl/ for the Arduino environment. Any Pull Requests for code changes should be opened there.

Arduino wolfSSL Library The library is modified from wolfSSL Release 566 for the Arduino platform wolfSSL Embedded SSL/TLS Library The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set It is com

The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3!

wolfSSL Embedded SSL/TLS Library The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set It is commonly used in standard operating environments as well because of its royalty-free pricing and excelle