Re: [Buildroot] [PATCH 1/1] package/wolfssl: security bump to version 5.5.0

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix the following security vulnerabilities:
 >  - [Low] Fault injection attack on RAM via Rowhammer leads to ECDSA key
 >    disclosure. Users doing operations with private ECC keys such as
 >    server side TLS connections and creating ECC signatures, who also
 >    have hardware that could be targeted with a sophisticated Rowhammer
 >    attack should update the version of wolfSSL and compile using the
 >    macro WOLFSSL_CHECK_SIG_FAULTS.
 >  - [Low] In wolfSSL version 5.3.0 if compiled with
 >    --enable-session-ticket and the client has non-empty session cache,
 >    with TLS 1.2 there is the possibility oàf a man in the middle passing
 >    a large session ticket to the client and causing a crash due to an
 >    invalid free. There is also the potential for a malicious TLS 1.3
 >    server to crash a client in a similar manner except in TLS 1.3 it is
 >    not susceptible to a man in the middle attack. Users on the client
 >    side with –enable-session-ticket compiled in and using wolfSSL
 >    version 5.3.0 should update their version of wolfSSL.
 >  - [Low] If using wolfSSL_clear to reset a WOLFSSL object (vs the normal
 >    wolfSSL_free/wolfSSL_new) it can result in runtime issues. This
 >    exists with builds using the wolfSSL compatibility layer
 >    (--enable-opnesslextra) and only when the application is making use
 >    of wolfSSL_clear instead of SSL_free/SSL_new. In the case of a TLS
 >    1.3 resumption, after continuing to use the WOLFSSH object after
 >    having called wolfSSL_clear, an application could crash. It is
 >    suggested that users calling wolfSSL_clear update the version of
 >    wolfSSL used.
 >  - Potential DoS attack on DTLS 1.2. In the case of receiving a
 >    malicious plaintext handshake message at epoch 0 the connection will
 >    enter an error state reporting a duplicate message. This affects both
 >    server and client side. Users that have DTLS enabled and in use
 >    should update their version of wolfSSL to mitigate the potential for
 >    a DoS attack.

 > https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2022.05.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot