[Git][security-tracker-team/security-tracker][master] Some more wolfssl issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
537505c5 by Salvatore Bonaccorso at 2026-06-26T09:45:31+02:00
Some more wolfssl issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -49,11 +49,14 @@ CVE-2026-6330 (The ML-KEM ARM64 NEON ciphertext comparison only compares half of
 	- wolfssl <unfixed>
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10192 (v5.9.2-stable)
 CVE-2026-6329 (PKCS#12 MAC verification uses an attacker-controlled comparison length ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10192 (v5.9.2-stable)
 CVE-2026-6325 (Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversiz ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10204 (v5.9.2-stable)
 CVE-2026-6092 (When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fal ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10167 (v5.9.2-stable)
 CVE-2026-57522 (Bitwarden Server before 2026.5.0 contains a JSON injection vulnerabili ...)
 	TODO: check
 CVE-2026-57521 (Bitwarden Server before 2026.5.0 contains a broken access control vuln ...)
@@ -63,13 +66,17 @@ CVE-2026-57520 (Bitwarden Server before 2026.5.0 contains a privilege escalation
 CVE-2026-56445 (The qrscp application's C-STORE handler uses a specific instance from  ...)
 	TODO: check
 CVE-2026-55964 (Chain intermediate CA:TRUE without keyCertSign accepted as a signing C ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
 CVE-2026-55962 (TLS 1.3 post-handshake authentication (PHA) issue where a server could ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
 CVE-2026-55960 (Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509  ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
 CVE-2026-55958 (Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In  ...)
-	TODO: check
+	- wolfssl <unfixed>
+	NOTE: NOTE: https://github.com/wolfSSL/wolfssl/pull/10705 (v5.9.2-stable)
 CVE-2026-54479 (The WebSocket backend uses charging station identifiers to uniquely as ...)
 	TODO: check
 CVE-2026-50745 (A missing sanitisation vulnerability exists with user input in the sta ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/537505c560dc6ce837632491a304cfc310816bbe

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/537505c560dc6ce837632491a304cfc310816bbe
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260626/10378ed4/attachment-0001.htm>