Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2020-12966 CVE-2021-46744 CVE-2022-34293 |
CWE-ID | CWE-200 CWE-310 CWE-254 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
wolfSSL Universal components / Libraries / Libraries used by multiple products |
Vendor | wolfSSL |
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU65122
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-12966
CWE-ID:
CWE-200 - Information Exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a Ciphertext side channel attack on ECC and DH operations in the Secure Encrypted Virtualization with Encrypted State (SEV-ES)
and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local user with control over hypervisor can obtain sensitive data from the guest OS.
Install update from vendor's website.
Vulnerable software versionswolfSSL: 2.0.3 - 5.3.0
http://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU63692
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2021-46744
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a ciphertext side channel attack where data in specific cryptographic algorithms can be inferred in a SEV guest by monitoring the ciphertext values over time. A local user with access to the hypervisor can gain access to sensitive information, related to the guest OS.
Install update from vendor's website.
Vulnerable software versionswolfSSL: 2.0.3 - 5.3.0
http://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65123
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-34293
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform DoS attack.
The vulnerability exists due to an implementation error in DTLS 1.0/1.2, which causes the return-routability check, intended to protect application against DoS attacks, to be wrongly skipped in a specific edge case. A remote attacker can perform a denial of service (DoS) attack by consuming excessive resources on the server.Install update from vendor's website.
Vulnerable software versionswolfSSL: 2.0.3 - 5.3.0
http://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?