PT-2019-16023 · Wolfssl · Wolfssl

Daniel Moghimi + 1 · Publicado 2019-12-24 · Atualizado 2021-07-21 · CVE-2019-19962

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0

Description The issue is related to the mishandling of calls to the wc SignatureGenerateHash function, which can lead to fault injection in RSA cryptography.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2019-19962

Produtos afetados

Wolfssl

Referências · 9

• https://github.com/wolfSSL/wolfssl/releases/tag/v4.3.0-stable · Nota
• https://github.com/wolfSSL/wolfssl/commit/23878512c65834d12811b1107d19a001478eca5d · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19962 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19962 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-19962 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19962 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19962 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-19962 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-19962 · Aviso do Fabricante