Vulnerabilities > Wolfssl
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-08-26 | CVE-2019-15651 | Out-of-bounds Read vulnerability in Wolfssl 4.1.0 wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex. | 7.5 |
| 2019-05-23 | CVE-2019-11873 | Out-of-bounds Write vulnerability in Wolfssl 4.0 wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. | 7.5 |
| 2019-01-16 | CVE-2019-6439 | Out-of-bounds Write vulnerability in Wolfssl examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow. | 7.5 |
| 2019-01-03 | CVE-2018-16870 | Cryptographic Issues vulnerability in Wolfssl It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. | 4.3 |
| 2018-06-15 | CVE-2018-12436 | Information Exposure vulnerability in Wolfssl wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. | 1.9 |
| 2017-12-13 | CVE-2017-13099 | Information Exposure Through Discrepancy vulnerability in multiple products wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. | 4.3 |
| 2017-10-06 | CVE-2014-2903 | Cryptographic Issues vulnerability in Wolfssl CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake. | 4.3 |
| 2017-05-24 | CVE-2017-2800 | Improper Certificate Validation vulnerability in Wolfssl A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. | 9.8 |
| 2017-05-09 | CVE-2017-8855 | Unspecified vulnerability in Wolfssl wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key. | 5.0 |
| 2017-05-09 | CVE-2017-8854 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Wolfssl wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file. | 6.8 |