PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Keeping the wolves out of wolfSSL

blog.trailofbits.com | vulnerability | #fuzzing | #cryptography | #tls | #vulnerability-disclosure | #dos
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits discloses four wolfSSL vulnerabilities (CVE-2022-38152, CVE-2022-38153, CVE-2022-39173, CVE-2022-42905) discovered automatically with tlspuffin, a Dolev-Yao model-guided protocol fuzzer. All four can cause denial of service, with CVSS scores from medium to critical.
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
vulnerability · blog.trailofbits.com
Out of the kernel, into the tokens
Trail of Bits details two disclosures: a 'billion hashes' DoS in JOSE libraries via attacker-controlled PBES2 iteration counts, and a KASLR bypass from privilege-less Linux containers.
vulnerability · blog.trailofbits.com
The issue with ATS in Apple’s macOS and iOS
Trail of Bits discloses CVE-2023-38596: Apple's ATS fails to enforce encryption for IP-address and .local connections, exposing iOS and macOS apps to MitM attacks and data exposure.
vulnerability · blog.trailofbits.com
Numbers turned weapons: DoS in Osmosis’ math library
Trail of Bits discloses a DoS in Osmosis' math library: an unbounded Taylor-series loop in PowApprox lets crafted transactions burn seconds of compute for little gas, enough to halt the chain.
vulnerability · blog.trailofbits.com
Avoiding Smart Contract “Gridlock” with Slither
Slither's dangerous-strict-equality detector catches the Edgeware 'Gridlock' DoS, where a strict balance assertion let attackers pre-fund a future contract address and freeze its lock() function.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Back