Denial of service in wolfSSL



Published: 2021-02-02 | Updated: 2021-02-16
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2021-3336
CWE-ID CWE-399
CWE-20
CWE-401
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
wolfSSL
Universal components / Libraries / Libraries used by multiple products

Vendor wolfSSL

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

Updated: 16.02.2021

Changed bulletin status to patched, added vulnerabilities #2-3, updated bulletin title.

1) Resource management error

EUVDB-ID: #VU50255

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3336

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the DoTls13CertificateVerify() function in tls13.c in wolfSSL continues to process requests after certain anomalous peer behavior, such as sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. A remote attacker can abuse this behavior to consume additional system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

wolfSSL: 2.0.3 - 4.6.0


CPE2.3 External links

http://github.com/wolfSSL/wolfssl/pull/3676
http://github.com/wolfSSL/wolfssl/releases/tag/v4.7.0-stable

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Input validation error

EUVDB-ID: #VU50735

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing a crafted compressed ECC key with enabled custom ECC curves. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

wolfSSL: 4.0 - 4.6.0


CPE2.3 External links

http://github.com/wolfSSL/wolfssl/releases/tag/v4.7.0-stable

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Memory leak

EUVDB-ID: #VU50736

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due memory leak with TLS 1.3 authenticated-only ciphers when TLS 1.3 early data is enabled. A section of the server hello could contains 16 bytes of uninitialized data when sent to the connected peer. A remote attacker can gain access to potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

wolfSSL: 4.0 - 4.6.0


CPE2.3 External links

http://github.com/wolfSSL/wolfssl/releases/tag/v4.7.0-stable

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###