CVE-2021-3336

Published: Jan 29, 2021Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

Affected (1)

Products: Wolfssl: Wolfssl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wolfssl Wolfssl	Before 4.7.0

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

https://github.com/wolfSSL/wolfssl/pull/3676

Source: cve@mitre.org

PatchThird Party Advisory

https://www.wolfssl.com/docs/security-vulnerabilities

Source: cve@mitre.org

Vendor Advisory

https://github.com/wolfSSL/wolfssl/pull/3676

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.wolfssl.com/docs/security-vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.