PT-2019-15694 · Wolfssl · Wolfssl

Jakub Botwicz · Published 2019-11-09 · Updated 2019-11-12 · CVE-2019-18840

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions 4.1.0 through 4.2.0c

Description The issue arises from missing sanity checks of memory accesses in parsing ASN.1 certificate data during handshaking. Specifically, a one-byte heap-based buffer overflow occurs inside the DecodedCert structure in the GetName function in wolfcrypt/src/asn.c. This happens because the domain name location index is mishandled, leading to a pointer being overwritten and resulting in an invalid free.

Recommendations For wolfSSL versions 4.1.0 through 4.2.0c, consider updating to a version that includes the necessary sanity checks for memory accesses in parsing ASN.1 certificate data to prevent the heap-based buffer overflow. As a temporary workaround, consider restricting the use of the GetName function in wolfcrypt/src/asn.c until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-18840

Affected Products

Wolfssl

References · 8

• 🔥 https://github.com/wolfSSL/wolfssl/issues/2555 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2019-18840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18840 · Security Note
• https://ubuntu.com/security/CVE-2019-18840 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18840 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18840 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18840 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18840 · Vendor Advisory