CVE-2022-42905: Out-of-bounds Read

November 7, 2022 (updated February 15, 2023)

In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)

References

github.com/wolfSSL/wolfssl/releases
nvd.nist.gov/vuln/detail/CVE-2022-42905
www.wolfssl.com/docs/security-vulnerabilities/

Code Behaviors & Features

Detect and mitigate CVE-2022-42905 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →