CVE-2021-3336

EPSS 0.35%
Published 29.01.2021 05:15:12
Last modified 21.11.2024 06:21:19
Source cve@mitre.org
Teams watchlist Login
Open Login

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Wolfssl ≫ Wolfssl Version < 4.7.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.35%	0.568

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://github.com/wolfSSL/wolfssl/pull/3676

Patch

Third Party Advisory

https://www.wolfssl.com/docs/security-vulnerabilities

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-3336

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-3336

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-3336

EUVD