CVE-2024-5991: Buffer overread in domain name matching
Buffer overread in domain name matching
Other sources
In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.6.9-4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.6.9-6 - Upgrade
Upgrade
wolfSSLto a version that resolves this vulnerability.Patch wolfSSL/wolfssl/pull/7604
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5991?
The severity of CVE-2024-5991 is currently classified as high due to the potential for denial of service or security bypass.
How do I fix CVE-2024-5991?
To fix CVE-2024-5991, upgrade to a version of wolfSSL later than 5.7.0 that addresses this vulnerability.
What software is affected by CVE-2024-5991?
CVE-2024-5991 affects all versions of wolfSSL up to and including 5.7.0.
What vulnerability does CVE-2024-5991 describe?
CVE-2024-5991 describes a vulnerability in the MatchDomainName() function where unchecked user input is treated as a NULL terminated string.
Can CVE-2024-5991 lead to remote exploitation?
Yes, CVE-2024-5991 has the potential to be exploited remotely due to improper handling of user input.