diff options
| author | Johan van Selst <johans@FreeBSD.org> | 2016-09-12 20:05:47 +0000 |
|---|---|---|
| committer | Johan van Selst <johans@FreeBSD.org> | 2016-09-12 20:05:47 +0000 |
| commit | dd38f2654517a5cf8c44fe460a6e31882aa0f448 (patch) | |
| tree | a4fed04547f26a694afc90049e84ce20e01a5dae /security | |
| parent | 628578572ad6c92750b87e4cbe229f78a2792731 (diff) | |
Document WolfSSL vulnerabilities (< 3.6.8)
PR: 205936
Submitted by: Christoph Moench-Tegeder
Notes
Notes:
svn path=/head/; revision=421955
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 39f538d7956a..e27384df8045 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,56 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a"> + <topic>wolfssl -- leakage of private key information</topic> + <affects> + <package> + <name></name> + <range><lt>3.6.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Florian Weimer of Redhat discovered that an optimization in + RSA signature validation can result in disclosure of the + server's private key under certain fault conditions.</p> + </body> + </description> + <references> + <url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url> + <url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url> + <cvename>CVE-2015-7744</cvename> + </references> + <dates> + <discovery>2015-09-17</discovery> + <entry>2016-01-05</entry> + </dates> + </vuln> + <vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96"> + <topic>wolfssl -- DDoS amplification in DTLS</topic> + <affects> + <package> + <name>wolfssl</name> + <range><lt>3.6.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Sebastian Ramacher identified an error in wolfSSL's implementation + of the server side of the DTLS handshake, which could be abused + for DDoS amplification or a DoS on the DTLS server itself.</p> + </body> + </description> + <references> + <url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url> + <url>https://github.com/IAIK/wolfSSL-DoS</url> + <cvename>CVE-2015-6925</cvename> + </references> + <dates> + <discovery>2015-09-18</discovery> + <entry>2016-01-05</entry> + </dates> + </vuln> <vuln vid="a0128291-7690-11e6-95a8-0011d823eebd"> <topic>gnutls -- OCSP validation issue</topic> <affects> |