CVE-2018-16870

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to leakage of sensible data.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-310

Affected software

Vendor	Product	Versions
n/a	wolfssl	before 3.15.7

References

http://cat.eyalro.net/Third Party Advisory
https://github.com/wolfSSL/wolfssl/pull/1950Patch, Third Party Advisory
http://cat.eyalro.net/Third Party Advisory
https://github.com/wolfSSL/wolfssl/pull/1950Patch, Third Party Advisory

Timeline

Published: Jan 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-168717.5A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mou CVE-2018-168725.3A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and dire CVE-2018-168738.1In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and CVE-2018-168748.1In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path o CVE-2018-168757.5The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification CVE-2018-168765.3ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to le CVE-2018-168777.8A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker CVE-2018-168785.5A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes CVE-2018-168799.8Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for mess CVE-2018-16885.4IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerab CVE-2018-168807.0A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,CVE-2018-168817.5A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptc