wolfSSL AES-GCM Authentication Tag Length Vulnerability in wc_PKCS7_DecodeAuthEnvelopedData

A vulnerability exists in wolfSSL's function wc_PKCS7_DecodeAuthEnvelopedData(), where the AES-GCM authentication tag length is not properly validated. This lack of lower bounds check allows a man-in-the-middle attacker to truncate the MAC field from 16 bytes to 1 byte, weakening the tag verification from 2⁻¹²⁸ to 2⁻⁸.

Impact

Exploitation of this vulnerability allows for a significant reduction in the security of the AES-GCM authentication tag, making it easier to bypass integrity checks.