2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"wolfSSL","programFiles":["wolfcrypt/src/pkcs7.c"],"repo":"https://github.com/wolfSSL/wolfssl","vendor":"wolfSSL","versions":[{"lessThan":"5.9.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"facts@wolfssl.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*","matchCriteriaId":"261C41E4-7F04-4C98-AD63-110136730EE9","versionEndExcluding":"5.9.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end-of-content verification loop in PKCS7_VerifySignedData()."},{"lang":"es","value":"Lectura fuera de límites en el heap al analizar PKCS7. Un mensaje PKCS7 manipulado puede desencadenar una lectura fuera de límites en el heap. La comprobación de límites faltante está en el bucle de verificación de fin de contenido de longitud indefinida en PKCS7_VerifySignedData()."}],"id":"CVE-2026-5392","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"facts@wolfssl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T14:08:38.837104Z","version":"2.0.3"}}]},"published":"2026-04-10T00:16:35.603","references":[{"source":"facts@wolfssl.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/wolfssl/wolfssl/pull/10039"}],"sourceIdentifier":"facts@wolfssl.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"facts@wolfssl.com","type":"Secondary"}]}
|