Vulnerabilities > Wolfssl > Wolfssl > 4.6.0
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-07-17 | CVE-2023-3724 | Improper Certificate Validation vulnerability in Wolfssl If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. | 8.8 |
2022-11-07 | CVE-2022-42905 | Out-of-bounds Read vulnerability in Wolfssl In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. | 9.1 |
2022-10-15 | CVE-2022-42961 | Unspecified vulnerability in Wolfssl An issue was discovered in wolfSSL before 5.5.0. | 5.3 |
2022-09-29 | CVE-2022-39173 | Out-of-bounds Write vulnerability in Wolfssl In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. | 7.5 |
2022-08-31 | CVE-2022-38152 | Improper Check for Unusual or Exceptional Conditions vulnerability in Wolfssl An issue was discovered in wolfSSL before 5.5.0. | 7.5 |
2022-02-24 | CVE-2022-25638 | Improper Certificate Validation vulnerability in Wolfssl In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. | 4.3 |
2022-02-24 | CVE-2022-25640 | Improper Certificate Validation vulnerability in Wolfssl In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. | 7.5 |
2021-08-12 | CVE-2021-38597 | Insufficient Verification of Data Authenticity vulnerability in Wolfssl wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. | 4.3 |
2021-07-21 | CVE-2021-37155 | Unspecified vulnerability in Wolfssl 4.6.0 wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response. | 7.5 |
2021-01-29 | CVE-2021-3336 | Improper Certificate Validation vulnerability in Wolfssl DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). | 6.8 |