Debian Wolfssl vulnerabilities

CVE-2021-38597 [MEDIUM] CVE-2021-38597: wolfssl - wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations o... wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. Scope: local bookworm: resolved (fixed in 5.0.0-1) bullseye: resolved (fixed in 4.6.0+p1-0+deb11u1) forky: resolved (fixed in 5.0.0-1) sid: resolved (fixed in 5.0.0-1) trixie: resolved (fixed in 5.0.0-1)

CVE-2022-42961 [MEDIUM] CVE-2022-42961: wolfssl - An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM... An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via an advanced technique for ECDSA key recovery. (In 5.5.0 and later, WO

CVE-2023-6937 [MEDIUM] CVE-2023-6937: wolfssl - wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not s... wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and the

CVE-2025-12889 [LOW] CVE-2025-12889: wolfssl - With TLS 1.2 connections a client can use any digest, specifically a weaker dige... With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 5.8.4-1) sid: resolved (fixed in 5.8.4-1) trixie: open

CVE-2020-11735 [MEDIUM] CVE-2020-11735: wolfssl - The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constan... The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak." Scope: local bookworm: resolved (fixed in 4.4.0+dfsg-1) bullseye: resolved (fixed in 4.4.0+dfsg-1) forky: resolved (fixed in 4.4.0+dfsg-1) sid: resolved (fixed in 4.4.0+dfsg-1) trixie: resol

CVE-2019-19960 [MEDIUM] CVE-2019-19960: wolfssl - In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel ... In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks. Scope: local bookworm: resolved (fixed in 4.3.0+dfsg-1) bullseye: resolved (fixed in 4.3.0+dfsg-1) forky: resolved (fixed in 4.3.0+dfsg-1) sid: resolved (fixed in 4.3.0+dfsg-1) trixie: resolved (fixed in 4.3.0+dfsg-1)

CVE-2019-19963 [MEDIUM] CVE-2019-19963: wolfssl - An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration w... An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce. Scope: local bookworm: resolved (fixed in 4.3.0+dfsg-1) bullseye: resolved (fixed in 4.3.0+dfsg-1) forky: resolved (fixed in 4.3.0+dfsg-1)

CVE-2026-3503 [MEDIUM] CVE-2026-3503: wolfssl - Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM a... Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): comm

CVE-2024-1544 [MEDIUM] CVE-2024-1544: wolfssl - Generating the ECDSA nonce k samples a random number r and then truncates this ... Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic curve. Meaning k = r mod n. The division used during the reduction estimates a factor q_e by dividing the upper two digits (a digit having e.g. a size of 8 byte) of r by the upper digit of n and then decrements

CVE-2024-1543 [MEDIUM] CVE-2024-1543: wolfssl - The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5... The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to: https://doi.or

CVE-2017-6076 [MEDIUM] CVE-2017-6076: wolfssl - In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier t... In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine. Scope: local bookworm: resolved (fixed in 3.10.2+dfsg-1) bullseye: resolved (fixed in 3.10.2+dfsg-1) forky: resolved (fixed in 3.10.2+dfsg-1) sid: resolved (fixed in 3.10.2+dfsg-1) trixie: resol

CVE-2021-24116 [MEDIUM] CVE-2021-24116: wolfssl - In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decodi... In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. Scope: local bookworm: resolved (fixed in 4.6.0-1

CVE-2026-3229 [LOW] CVE-2026-3229: wolfssl - An integer overflow vulnerability existed in the static function wolfssl_add_to_... An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer. wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3r

CVE-2020-24585 [MEDIUM] CVE-2020-24585: wolfssl - An issue was discovered in the DTLS handshake implementation in wolfSSL before 4... An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application. Scope: local bookworm: resolved (fixed in 4.5.0+dfsg-1) bullseye: resolved (fixed in 4.5.0+dfsg-1) forky: resolved (fixed in 4.5.0+dfsg-1

CVE-2016-7438 [MEDIUM] CVE-2016-7438: wolfssl - The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 ... The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences. Scope: local bookworm: resolved (fixed in 3.9.10+dfsg-1) bullseye: resolved (fixed in 3.9.10+dfsg-1) forky: resolved (fixed in 3.9.10+dfsg-1) sid: resolved (fixed in 3.9.10+dfsg-1) trixie: reso

CVE-2016-7439 [MEDIUM] CVE-2016-7439: wolfssl - The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 ... The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences. Scope: local bookworm: resolved (fixed in 3.9.10+dfsg-1) bullseye: resolved (fixed in 3.9.10+dfsg-1) forky: resolved (fixed in 3.9.10+dfsg-1) sid: resolved (fixed in 3.9.10+dfsg-1) trixie: reso

CVE-2016-7440 [MEDIUM] CVE-2016-7440: wolfssl - The C software implementation of AES Encryption and Decryption in wolfSSL (forme... The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences. Scope: local bookworm: resolved (fixed in 3.9.10+dfsg-1) bullseye: resolved (fixed in 3.9.10+dfsg-1) forky: resolved (fixed in 3.9.10+dfsg-1) sid: resolved (fixed i

CVE-2026-3580 [LOW] CVE-2026-3580: wolfssl - In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optim... In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -O3. This transformation breaks the side-channel resistance of ECC scalar multiplication, potentially allowing a local attacker to recover secret keys via timing analysis. Scope: local bookworm: open bullseye: ope

CVE-2018-12436 [MEDIUM] CVE-2018-12436: wolfssl - wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-ch... wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. Scope: local bookworm: resolved (fixed in 3.15.3+dfsg-1) bul

CVE-2025-11932 [LOW] CVE-2025-11932: wolfssl - The server previously verified the TLS 1.3 PSK binder using a non-constant time ... The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder Scope: local bookworm: open bullseye: open forky: resolved (fixed in 5.8.4-1) sid: resolved (fixed in 5.8.4-1) trixie: open