In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging).
Solution:
Workaround:
The product reads data past the end, or before the beginning, of the intended buffer.
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
| Link | Tags |
|---|---|
| https://github.com/wolfSSL/wolfssl/pull/6949/ | issue tracking patch |
| https://www.wolfssl.com/docs/security-vulnerabilities/ | vendor advisory |