CVE-2024-5991CWE-125

Buffer overread in domain name matching

Critical · published August 27, 2024

CVSS v4.0
10.0
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-08-27T18:33Z
EPSS history
Timeline
  • 27 AUG 18:33Z
    Buffer overread in domain name matching
    cvelistv5