CVE-2021-3336

EUVD-2021-26667
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Affected Products (NVD)
VendorProductVersion
wolfsslwolfssl
𝑥
< 4.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wolfssl
bookworm
5.5.4-2+deb12u1
fixed
bullseye
4.6.0+p1-0+deb11u2
no-dsa
sid
5.7.2-0.1
fixed
trixie
5.7.2-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
wolfssl
bionic
needed
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needed
trusty
dne
xenial
needed
Common Weakness Enumeration
References
https://github.com/wolfSSL/wolfssl/pull/3676
https://www.wolfssl.com/docs/security-vulnerabilities
https://github.com/wolfSSL/wolfssl/pull/3676
https://www.wolfssl.com/docs/security-vulnerabilities