Vulnerabilities > CVE-2019-14317 - Insufficient Entropy vulnerability in Wolfssl

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

wolfssl

CWE-331

NVD

Published: 2019-12-11

Updated: 2021-07-21

Summary

wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces.

Vulnerable Configurations

Part	Description	Count
Application	Wolfssl Wolfssl Wolfssl - Wolfssl Wolfssl 0.5 Wolfssl Wolfssl 1.8.8.0 Wolfssl Wolfssl 1.9.0 Wolfssl Wolfssl 2.0.2 Wolfssl Wolfssl 2.0.3 Wolfssl Wolfssl 2.0.6 Wolfssl Wolfssl 2.0.8 Wolfssl Wolfssl 2.1.1 Wolfssl Wolfssl 2.1.2 Wolfssl Wolfssl 2.1.4 Wolfssl Wolfssl 2.2.0 Wolfssl Wolfssl 2.2.1 Wolfssl Wolfssl 2.2.2 Wolfssl Wolfssl 2.3.0 Wolfssl Wolfssl 2.4.0 Wolfssl Wolfssl 2.4.2 Wolfssl Wolfssl 2.4.6 Wolfssl Wolfssl 2.4.7 Wolfssl Wolfssl 2.5.0 Wolfssl Wolfssl 2.5.2 Wolfssl Wolfssl 2.6.0 Wolfssl Wolfssl 2.6.2 Wolfssl Wolfssl 2.7.0 Wolfssl Wolfssl 2.7.2 Wolfssl Wolfssl 2.8.0 Wolfssl Wolfssl 2.8.2 Wolfssl Wolfssl 2.8.3 Wolfssl Wolfssl 2.8.4 Wolfssl Wolfssl 2.8.5 Wolfssl Wolfssl 2.8.6 Wolfssl Wolfssl 2.9.0 Wolfssl Wolfssl 2.9.1 Wolfssl Wolfssl 2.9.2 Wolfssl Wolfssl 2.9.4 Wolfssl Wolfssl 3.0.0 Wolfssl Wolfssl 3.0.2 Wolfssl Wolfssl 3.1.0 Wolfssl Wolfssl 3.2.0 Wolfssl Wolfssl 3.2.4 Wolfssl Wolfssl 3.2.6 Wolfssl Wolfssl 3.3.0 Wolfssl Wolfssl 3.3.2 Wolfssl Wolfssl 3.3.3 Wolfssl Wolfssl 3.4.0 Wolfssl Wolfssl 3.4.2 Wolfssl Wolfssl 3.4.6 Wolfssl Wolfssl 3.4.8 Wolfssl Wolfssl 3.6.0 Wolfssl Wolfssl 3.6.2 Wolfssl Wolfssl 3.6.6 Wolfssl Wolfssl 3.6.8 Wolfssl Wolfssl 3.6.9 Wolfssl Wolfssl 3.7.0 Wolfssl Wolfssl 3.7.1 Wolfssl Wolfssl 3.7.3 Wolfssl Wolfssl 3.8.0 Wolfssl Wolfssl 3.9.0 Wolfssl Wolfssl 3.9.1 Wolfssl Wolfssl 3.9.6 Wolfssl Wolfssl 3.9.8 Wolfssl Wolfssl 3.9.10 Wolfssl Wolfssl 3.10.0 Wolfssl Wolfssl 3.10.0A Wolfssl Wolfssl 3.10.2 Wolfssl Wolfssl 3.10.3 Wolfssl Wolfssl 3.10.4 Wolfssl Wolfssl 3.11.0 Wolfssl Wolfssl 3.11.1 Wolfssl Wolfssl 3.12.0 Wolfssl Wolfssl 3.12.2 Wolfssl Wolfssl 3.13.0 Wolfssl Wolfssl 3.13.2 Wolfssl Wolfssl 3.13.3 Wolfssl Wolfssl 3.14.0 Wolfssl Wolfssl 3.14.2 Wolfssl Wolfssl 3.14.4 Wolfssl Wolfssl 3.14.5 Wolfssl Wolfssl 3.15.0 Wolfssl Wolfssl 3.15.3 Wolfssl Wolfssl 3.15.5 Wolfssl Wolfssl 3.15.6 Wolfssl Wolfssl 3.15.7 Wolfssl Wolfssl 3.15.8 Wolfssl Wolfssl 4.0 Wolfssl Wolfssl 4.0.0 Wolfssl Wolfssl 4.1.0	96

Common Weakness Enumeration (CWE)

CWE-331 - Insufficient Entropy

Common Attack Pattern Enumeration and Classification (CAPEC)

Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

References

https://www.wolfssl.com/docs/security-vulnerabilities/