wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• wolfssl wolfsslbefore 4.3.0

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-11873wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size.
  42Plan
• CVE-2017-2800A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certif
  42Plan
• CVE-2024-5991Buffer overread in domain name matching
  40Plan
• CVE-2020-36177RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest s
  40Plan
• CVE-2014-2898wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers
  40Plan
• CVE-2014-2897The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows re
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const claims = jwt.verify(token, publicKey);

1const claims = jwt.verify(token, publicKey, {2  algorithms: ["RS256"],3  issuer: "https://id.example.com",4  audience: "portal",5});

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.