Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2021-3336 →

DEBIAN-CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448,...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 wolfssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-3"}]}]

Debian:13 wolfssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-3"}]}]

Références

advisory security-tracker.debian.org