Jaehun Lee

6 exploits Active since Feb 2018
CVE-2017-18187 WRITEUP CRITICAL WRITEUP
ARM mbed TLS < 2.7.0 - Integer Overflow in PSK Identity Parsing
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.
CVSS 9.8
CVE-2022-23408 WRITEUP CRITICAL WRITEUP
wolfSSL 5.0.0-5.1.0 - Use of Insufficiently Random Values in AES-CBC and DES3 Connections
wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c.
CVSS 9.1
CVE-2024-1543 WRITEUP MEDIUM WRITEUP
wolfssl < 5.6.6 - Observable Timing Discrepancy in T-Table Implementation
The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to: https://doi.org/10.46586/tches.v2024.i1.457-500
CVSS 4.1
CVE-2024-5814 WRITEUP MEDIUM WRITEUP
wolfssl < 5.7.0 - TLS Ciphersuite Downgrade via Incomplete Server Hello Parsing
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500
CVSS 5.3
CVE-2025-7394 WRITEUP CRITICAL WRITEUP
wolfssl 3.15.0-5.8.0 - Use of Cryptographically Weak Pseudo-Random Number Generator via RAND_bytes() After fork()
In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers generated in applications that are both using RAND_bytes() and doing fork() operations. This only affects applications explicitly calling RAND_bytes() after fork() and does not affect any internal TLS operations. Although RAND_bytes() documentation in OpenSSL calls out not being safe for use with fork() without first calling RAND_poll(), an additional code change was also made in wolfSSL to make RAND_bytes() behave similar to OpenSSL after a fork() call without calling RAND_poll(). Now the Hash-DRBG used gets reseeded after detecting running in a new process. If making use of RAND_bytes() and calling fork() we recommend updating to the latest version of wolfSSL. Thanks to Per Allansson from Appgate for the report.
CVSS 9.8
CVE-2025-7396 WRITEUP MEDIUM WRITEUP
wolfSSL - Covert Timing Channel in Curve25519 Implementation
In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.
CVSS 4.6