wolfSSL X.509 Date Buffer Overflow Vulnerability

A buffer overflow vulnerability has been identified in wolfSSL's X.509 date parsing functions, wolfSSL_X509_notAfter and wolfSSL_X509_notBefore. This issue arises in the compatibility layer API when handling date fields from a specially crafted X.509 certificate. The vulnerability is triggered only when these functions are called directly from an application, and does not impact TLS or certificate verification processes in wolfSSL.

Impact

Exploitation of this vulnerability can lead to a buffer overflow, which may be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Users can apply the latest version of wolfSSL, which includes a bounds check for the wolfSSL_X509_notBefore and wolfSSL_X509_notAfter functions, to address this vulnerability.