Lucene search

Ubuntu.comUB:CVE-2021-3336

HistoryJan 29, 2021 - 12:00 a.m.

CVE-2021-3336

2021-01-2900:00:00

ubuntu.com

wolfssl

tls 1.3

vulnerability

cve-2021-3336

unix

dotls13certificateverify

anomalous peer behavior

man-in-the-middle

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.8%

JSON

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease
processing for certain anomalous peer behavior (sending an ED22519, ED448,
ECC, or RSA signature without the corresponding certificate). The client
side is affected because man-in-the-middle attackers can impersonate TLS
1.3 servers.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchwolfssl< anyUNKNOWN
ubuntu20.04noarchwolfssl< anyUNKNOWN
ubuntu22.04noarchwolfssl< anyUNKNOWN
ubuntu24.04noarchwolfssl< anyUNKNOWN
ubuntu16.04noarchwolfssl< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	wolfssl	< any	UNKNOWN
ubuntu	20.04	noarch	wolfssl	< any	UNKNOWN
ubuntu	22.04	noarch	wolfssl	< any	UNKNOWN
ubuntu	24.04	noarch	wolfssl	< any	UNKNOWN
ubuntu	16.04	noarch	wolfssl	< any	UNKNOWN

References

github.com/wolfSSL/wolfssl/pull/3676

launchpad.net/bugs/cve/CVE-2021-3336

nvd.nist.gov/vuln/detail/CVE-2021-3336

security-tracker.debian.org/tracker/CVE-2021-3336

www.cve.org/CVERecord?id=CVE-2021-3336

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.8%

JSON

Related for UB:CVE-2021-3336