Description
wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸.
Problem types
CWE-20 Improper input validation
Product status
Any version
Credits
Calif.io in collaboration with Claude and Anthropic Research
References
github.com/wolfSSL/wolfssl/pull/10102