PT-2019-12534 · Wolfssl · Wolfssl

Published 2019-05-23 · Updated 2022-04-22 · CVE-2019-11873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL version 4.0.0

Description The issue arises from a buffer overflow in the DoPreSharedKeys function in tls13.c, specifically when the current identity size exceeds the client identity size. An attacker can exploit this by sending a crafted hello client packet to a TLSv1.3 wolfSSL server, where the packet's length fields (record length, client hello length, total extensions length, PSK extension length, total identity length, and identity length) are set to their maximum value of 2^16. The identity data field of the PSK extension contains the attack data, which is then stored in undefined memory on the server, with a size of approximately 65 kB. This could potentially allow for a remote code execution attack.

Recommendations For wolfSSL version 4.0.0, as a temporary workaround, consider disabling the DoPreSharedKeys function in tls13.c until a patch is available. Restrict access to the TLSv1.3 protocol to minimize the risk of exploitation. Avoid using the PSK extension in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-11873

Affected Products

Wolfssl

References · 10

• https://telekom.com/resource/blob/572524/1c89c1cbaccdf792153063b3a10af10e/dl-190515-remote-buffer-overflow-vulnerability-wolfssl-library-data.pdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11873 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-11873 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11873 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11873 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11873 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11873 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11873 · Vendor Advisory
• https://telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842 · Note
• http://securityfocus.com/bid/108466 · Note