Skip to content
OpenAdvisories
Critical · 10.0 CVE-2024-5991 EUVD-2024-47107GHSA-jwjf-h4v6-qrpp

Buffer overread in domain name matching

Published Aug 27, 2024 · Updated Aug 27, 2024 · Assigned by wolfSSL

Description

In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.

Affected products

VendorProductAffectedFixed
wolfSSL wolfSSL ≤ 5.7.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 wolfssl 5.7.2-0.1 —
Debian 12 wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wolfssl No fix yet —
Ubuntu 26.04 LTS wolfssl No fix yet —
Ubuntu 25.10 wolfssl No fix yet —
Ubuntu 24.04 LTS wolfssl No fix yet —
Ubuntu 22.04 LTS wolfssl No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wolfssl No fix yet —
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 wolfssl 5.7.2-r0 —
Alpine v3.23 wolfssl 5.7.2-r0 —
Alpine v3.22 wolfssl 5.7.2-r0 —
Alpine v3.21 wolfssl 5.7.2-r0 —
Alpine v3.20 wolfssl 5.7.2-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 mariadb 10.6.9-6 —
Azure Linux 2 (CBL-Mariner) mariadb 10.6.9-4 —

References