Fault Injection Vulnerability in wolfSSL Cryptography
CVE-2019-19962

7.5HIGH

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
25 December 2019

What is CVE-2019-19962?

wolfSSL versions prior to 4.3.0 are susceptible to a fault injection vulnerability due to improper handling of calls to wc_SignatureGenerateHash. This issue can potentially undermine the integrity of RSA cryptographic operations, allowing attackers to exploit the system's cryptographic functions. Users should upgrade to the latest version to mitigate risks associated with this vulnerability.

References

https://github.com/wolfSSL/wolfssl/releases/tag/v4.3.0-st...
x_refsource_MISC
https://github.com/wolfSSL/wolfssl/commit/23878512c65834d...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.