2 lines
3.9 KiB
JSON
2 lines
3.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"wolfSSL","repo":"https://github.com/wolfSSL/wolfssl","vendor":"wolfSSL","versions":[{"lessThan":"5.9.1","status":"affected","version":"0","versionType":"server"}]}],"source":"facts@wolfssl.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*","matchCriteriaId":"261C41E4-7F04-4C98-AD63-110136730EE9","versionEndExcluding":"5.9.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS or certificate verify operations in wolfSSL."},{"lang":"es","value":"Desbordamiento de búfer de fecha X.509 en wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. Puede producirse un desbordamiento de búfer al analizar campos de fecha de un certificado X.509 manipulado a través de la API de la capa de compatibilidad. Esto solo se activa al llamar a estas dos API directamente desde una aplicación, y no afecta las operaciones de verificación de TLS o de certificados en wolfSSL."}],"id":"CVE-2026-5448","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"facts@wolfssl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5448","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T13:51:49.237675Z","version":"2.0.3"}}]},"published":"2026-04-10T00:16:35.890","references":[{"source":"facts@wolfssl.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/wolfSSL/wolfssl/pull/10071"}],"sourceIdentifier":"facts@wolfssl.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"facts@wolfssl.com","type":"Secondary"}]}
|