VDB
CVE-2023-6936
CVE-2023-6936
PUBLISHED
CVSS 5.300000190734863 MEDIUM
In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging).
EPSS 0.27% · 50.9th percentile
Risk Scores
CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.27%
50.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfssl | wolfssl | 0, 0, 0 |
| wolfssl | wolfssl | 0, 0 |
| wolfSSL | wolfSSL | 0, 0 |
Timeline
- Jan 20, 1970 Fix PR Merged
- Feb 20, 2024 CVE Published
- Feb 20, 2024 PoC Published
- Feb 20, 2024 PoC Published
- Feb 21, 2024 EPSS Score
- Feb 21, 2024 PoC Published
- Mar 9, 2024 PoC Published
- Mar 19, 2024 EPSS Score
- Apr 15, 2024 EPSS Score
- May 11, 2024 EPSS Score
- Jun 7, 2024 EPSS Score
- Jul 4, 2024 EPSS Score