wolfSSL Certificate Verification Vulnerability Allowing Domain Name Mismatches

A vulnerability exists in wolfSSL versions 5.7.6 prior to 5.8.2 when built with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options. This issue causes the wolfSSL client to improperly verify server certificate domain names, accepting any certificate from a trusted CA regardless of hostname. The flaw arises because the native certificate validation on Apple platforms overrides important verification errors, including those related to hostname matching, allowing insecure connections to be established.

Impact

Exploitation of this vulnerability could lead to man-in-the-middle attacks, as clients may accept fraudulent certificates, allowing attackers to intercept or alter communications.

Remediation

Users are advised to update wolfSSL to version 5.8.2 or later. For those using the OpenSSL compatibility layer, ensure that the native certificate validation feature is disabled on Apple platforms.