CVE-2021-3336 — Improper Certificate Validation in Wolfssl

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.2%
top 60.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WolfsslDebian Wolfssl
Timeline
PublishedJan 29
Latest updateMay 24

Description

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/wolfssl< wolfssl 4.6.0-3 (bookworm)
▶NVDwolfssl/wolfssl< 4.7.0
▶Debianwolfssl/wolfssl< 4.6.0-3+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qfqh-45q8-8425: DoTls13CertificateVerify in tls13↗2022-05-24
▶
OSV
CVE-2021-3336: DoTls13CertificateVerify in tls13↗2021-01-29
▶

📋Vendor Advisories

1
Debian
CVE-2021-3336: wolfssl - DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease proce...↗2021
▶
CVE-2021-3336 — Improper Certificate Validation | cvebase