Description
wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate.
References
- http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html
- http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html
- GLSA-201612-53 vendor-advisory
- [oss-security] 20140417 CVE ids for CyaSSL 2.9.4? mailing-list
- 66780 vdb-entry
- [oss-security] 20140418 Re: CVE ids for CyaSSL 2.9.4? mailing-list
- 57743 third-party-advisory