CVE-2014-2903: Medium severity wolfssl wolfmqtt vulnerability
Published Oct 6, 2017
·Updated
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake.
Affected Software
2 affected componentsFixes available
debian/wolfssl
4.6.0+p1-0+deb11u25.5.4-2+deb12u15.7.0-0.3
wolfSSL wolfssl<=2.9.4
Event History
Oct 6, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-2903?
CVE-2014-2903 is considered a moderate vulnerability due to the risk of server spoofing using crafted certificates.
2
How do I fix CVE-2014-2903?
To fix CVE-2014-2903, update the wolfSSL package to at least version 4.6.0+p1-0+deb11u2 or to a later version.
3
Which software is affected by CVE-2014-2903?
CVE-2014-2903 affects wolfSSL versions up to and including 2.9.4 and specific Debian packages thereof.
4
Can CVE-2014-2903 be exploited remotely?
Yes, CVE-2014-2903 can be exploited remotely by attackers using specially crafted server certificates.
5
What type of attack does CVE-2014-2903 facilitate?
CVE-2014-2903 facilitates man-in-the-middle attacks by allowing attackers to spoof server identity during SSL/TLS handshakes.