VDB
CVE-2021-3336
CVE-2021-3336
PUBLISHED
CVSS 8.100000381469727 HIGH
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.
EPSS 0.79% · 53.8th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.79%
53.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | wolfssl | 5.6.6-1.3, 5.6.6-1.3build1, 5.5.4-2 |
| Ubuntu:20.04:LTS | wolfssl | *, *, * |
| Ubuntu:22.04:LTS | wolfssl | 0, 5.2.0-2, 5.2.0-1 |
| Ubuntu:25.10 | wolfssl | 0, 5.7.2-0.1 |
| Ubuntu:18.04:LTS | wolfssl | *, *, 0 |
| Ubuntu:16.04:LTS | wolfssl | 0, * |
Timeline
- Jan 29, 2021 CVE Published
- Mar 4, 2021 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-3336 third-party-advisory
- https://github.com/wolfSSL/wolfssl/pull/3676 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3336 third-party-advisory