2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"wolfSSL","programFiles":["src/tls.c"],"repo":"https://github.com/wolfSSL/wolfssl","vendor":"wolfSSL","versions":[{"lessThan":"5.9.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"facts@wolfssl.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*","matchCriteriaId":"261C41E4-7F04-4C98-AD63-110136730EE9","versionEndExcluding":"5.9.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object upon encountering an error. The caller then invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey, resulting in writes of zero bytes over freed heap memory."},{"lang":"es","value":"Existe un uso después de liberación de la pila en el procesamiento híbrido de KeyShare de criptografía postcuántica (PQC) de TLS 1.3 de wolfSSL. En la ruta de manejo de errores de TLSX_KeyShare_ProcessPqcHybridClient() en src/tls.c, la función interna TLSX_KeyShare_ProcessPqcClient_ex() libera un objeto KyberKey al encontrar un error. El llamador luego invoca TLSX_KeyShare_FreeAll(), que intenta llamar a ForceZero() en el KyberKey ya liberado, lo que resulta en escrituras de cero bytes sobre memoria de la pila liberada."}],"id":"CVE-2026-5460","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"facts@wolfssl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5460","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T13:51:11.637858Z","version":"2.0.3"}}]},"published":"2026-04-10T00:16:36.033","references":[{"source":"facts@wolfssl.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/wolfssl/wolfssl/pull/10092"}],"sourceIdentifier":"facts@wolfssl.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"facts@wolfssl.com","type":"Secondary"}]}
|