CVE-2018-16870 Weak cryptography in wolfssl

Medium 5.9 Published 3 Jan 2019 Updated 5 Aug 2024

Attackers can exploit a Bleichenbacher variant to downgrade TLS connections, potentially leaking sensitive data from applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-16870?

CVE-2018-16870 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 3 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to leakage of sensible data.

Weakness: CWE-310, CWE-200

Which versions are affected by CVE-2018-16870?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2018-16870?

Upgrade to a fixed version.

Is CVE-2018-16870 being exploited?

There is no known exploitation of CVE-2018-16870 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-16870, GHSA-ch8h-fr7v-29p6, UBUNTU-CVE-2018-16870.