PT-2024-6325 · Wolfssl+2 · Wolfssl+2
Published
2024-05-31
·
Updated
2025-07-22
·
CVE-2024-5991
CVSS v4.0
10
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
wolfSSL versions through 5.7.0
Description
The issue is related to the function MatchDomainName() in the wolfSSL library, where the input parameter
str is treated as a NULL terminated string despite being user-provided and unchecked. This can lead to an out-of-bounds read when dealing with non-NULL terminated strings in the function X509 check host(). The problem may allow a remote attacker to impact the availability of protected information.Recommendations
For wolfSSL versions through 5.7.0, as a temporary workaround, consider disabling the
MatchDomainName() function until a patch is available. Restrict access to the X509 check host() function to minimize the risk of exploitation. Avoid using non-NULL terminated strings in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Wolfssl