ALT-PU-2021-1353

Высокий

ALT-PU-2021-1353: package wolfssl update to version 4.7.0-alt1

Источник

errata.altlinux.org

Дата публикации

17.02.2021

Дата обновления

17.02.2021

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades wolfssl to version 4.7.0-alt1.

Устраненные уязвимости1

CVE-2021-3336

Высокий 8.1

Дата публикации: 29.01.2021

CWE-295

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

CVSS 3.1

Высокий 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Средний 6.8

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2021-3336 https://nvd.nist.gov/vuln/detail/CVE-2021-3336

Ссылки1

ALT-PU-2021-1353 https://errata.altlinux.org/ALT-PU-2021-1353

Связанные уязвимости

CVE-2021-3336

CVSS3: 8.1

ubuntu

почти 6 лет назад

CVE-2021-3336

CVSS3: 8.1

nvd

почти 6 лет назад

CVE-2021-3336

CVSS3: 8.1

debian

почти 6 лет назад

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not c ...

GHSA-qfqh-45q8-8425

github

больше 4 лет назад

DoTls13CertificateVerify in tls13.c in wolfSSL through 4.6.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate).