PT-2021-21537 · Wolfssl+1 · Wolfssl+1

Haydenroche5 · Published 2021-07-13 · Updated 2021-07-29 · CVE-2021-37155

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions 4.6.x through 4.7.x

Description The issue arises when the serial number in an OCSP request does not match the serial number in the OCSP response, but instead of producing a failure outcome, the process continues.

Recommendations For versions 4.6.x through 4.7.x, update to version 4.8.0 or later to resolve the issue.

Fix

Related Identifiers

ALT-PU-2021-2225

CVE-2021-37155

Affected Products

Alt Linux

Wolfssl

References · 9

• https://github.com/wolfSSL/wolfssl/pull/3990 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-37155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37155 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37155 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37155 · Security Note
• https://ubuntu.com/security/CVE-2021-37155 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37155 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases/tag/v4.8.0-stable · Note