CVE-2023-6935

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6935
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6935.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-6935
Related
Published
2024-02-09T23:15:08Z
Modified
2024-11-09T00:59:48.081894Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure:

--enable-all CFLAGS="-DWOLFSSLSTATICRSA"

The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is not recommended, and has been disabled by default since wolfSSL 3.6.6.  Therefore the default build since 3.6.6, even with "--enable-all", is not vulnerable to the Marvin Attack. The vulnerability is specific to static RSA cipher suites, and expected to be padding-independent.

The vulnerability allows an attacker to decrypt ciphertexts and forge signatures after probing with a large number of test observations. However the server’s private key is not exposed.

References

Affected packages

Debian:11 / wolfssl

Package

Name
wolfssl
Purl
pkg:deb/debian/wolfssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.6.0-3
4.6.0+p1-0+deb11u1
4.6.0+p1-0+deb11u2

5.*

5.0.0-1~bpo11+1
5.0.0-1
5.1.1-1~bpo11+1
5.1.1-1
5.2.0-1
5.2.0-2~bpo11+1
5.2.0-2
5.5.3-1
5.5.3-2
5.5.3-3~bpo11+1
5.5.3-3
5.5.4-1
5.5.4-2~bpo11+1
5.5.4-2
5.5.4-2.1
5.6.4-1
5.6.4-2
5.6.6-1
5.6.6-1.1
5.6.6-1.2
5.6.6-1.3~exp1
5.6.6-1.3
5.7.0-0.1
5.7.0-0.2
5.7.0-0.3
5.7.2-0.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / wolfssl

Package

Name
wolfssl
Purl
pkg:deb/debian/wolfssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.5.4-2
5.5.4-2+deb12u1
5.5.4-2.1
5.6.4-1
5.6.4-2
5.6.6-1
5.6.6-1.1
5.6.6-1.2
5.6.6-1.3~exp1
5.6.6-1.3
5.7.0-0.1
5.7.0-0.2
5.7.0-0.3
5.7.2-0.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / wolfssl

Package

Name
wolfssl
Purl
pkg:deb/debian/wolfssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.6.6-1.2

Affected versions

5.*

5.5.4-2
5.5.4-2.1
5.6.4-1
5.6.4-2
5.6.6-1
5.6.6-1.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/wolfssl/wolfssl

Affected ranges

Type
GIT
Repo
https://github.com/wolfssl/wolfssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

Other

WCv4-rng-stable
WCv4-stable
l
list
wolfRand-RC2

WCv4.*

WCv4.0-RC5
WCv4.0-RC6
WCv4.0-RC8
WCv4.0-RC9

WCv5.*

WCv5.0-RC10
WCv5.0-RC11
WCv5.0-RC12
WCv5.0-RC9
WCv5.2.1-PILOT

v0.*

v0.5

v1.*

v1.8.8.0
v1.9.0

v2.*

v2.0.2
v2.0.3
v2.0.6
v2.0.8
v2.0rc1
v2.0rc2
v2.0rc2b
v2.0rc3
v2.1.1
v2.1.2
v2.1.4
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.4.2
v2.4.6
v2.4.7
v2.5.0
v2.5.2
v2.5.2b
v2.6.0
v2.6.2
v2.7.0
v2.7.2
v2.8.0
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.5a
v2.8.6
v2.9.0
v2.9.1
v2.9.2
v2.9.4

v3.*

v3.0.0
v3.0.2
v3.1.0
v3.10.0-stable
v3.10.0a
v3.10.2-stable
v3.10.3
v3.10.4
v3.11.0-stable
v3.11.1-tls13-beta
v3.12.0-stable
v3.12.2-stable
v3.13.0-stable
v3.13.2
v3.13.3
v3.14.0-stable
v3.14.0a
v3.14.0b
v3.14.2
v3.14.4
v3.14.5
v3.15.0-stable
v3.15.3-stable
v3.15.5-stable
v3.15.5a
v3.15.6
v3.15.7-stable
v3.15.8
v3.2.0
v3.2.4
v3.2.6
v3.3.0
v3.3.3
v3.4.0
v3.4.2
v3.4.6
v3.4.8
v3.6.0
v3.6.0b
v3.6.2
v3.6.6
v3.6.8
v3.6.9
v3.6.9b
v3.6.9c
v3.6.9d
v3.69.d
v3.7.0
v3.7.1
v3.7.3
v3.8.0
v3.9.0
v3.9.1
v3.9.10-stable
v3.9.10b
v3.9.6
v3.9.6w
v3.9.8

v4.*

v4.0.0-stable
v4.1.0-stable
v4.2.0-stable
v4.2.0c
v4.3.0-stable
v4.4.0-stable
v4.5.0-stable
v4.6.0-stable
v4.7.0-stable
v4.7.1r
v4.8.0-stable

v5.*

v5.0.0-stable
v5.1.0-stable
v5.2.0-stable
v5.3.0-stable
v5.4.0-stable
v5.5.0-stable
v5.5.1-stable
v5.5.2-stable
v5.5.3-stable
v5.5.4-stable
v5.6.0-stable
v5.6.2-stable
v5.6.3-stable
v5.6.4-stable