Function MatchDomainName() vulnerable to buffer overflow due to unchecked user input

CVE-2024-5991

Summary

The vulnerability in wolfSSL arises from insufficient input validation within the MatchDomainName() function. The function improperly treats a user-provided input parameter as a NULL terminated string without checks, which can lead to unsafe memory access. Specifically, when the X509_check_host() function processes non-NULL terminated buffers, it risks reading beyond the intended bounds of the input array. This flaw can potentially result in buffer overflow conditions, creating a risk for the integrity and availability of the application. Users of wolfSSL versions prior to 5.7.0 should review their implementations to mitigate risks associated with this vulnerability.

References