Skip to content

wolfSSL Release 4.8.1 (July 16, 2021)
Compare
Choose a tag to compare
@JacobBarthelmeh JacobBarthelmeh released this 23 Jul 16:25
· 9820 commits to master since this release
v4.8.1-stable
723ed00

wolfSSL Release 4.8.1 (July 16, 2021)

Release 4.8.1 of wolfSSL embedded TLS has an OCSP vulnerability fix:

Vulnerabilities

  • [High] OCSP verification issue when response is for a certificate with no relation to the chain in question BUT that response contains the NoCheck extension which effectively disables ALL verification of that one cert. Users who should upgrade to 4.8.1 are TLS client users doing OCSP, TLS server users doing mutual auth with OCSP, and CertManager users doing OCSP independent of TLS. Thanks to Jan Nauber, Marco Smeets, Werner Rueschenbaum and Alissa Kim of Volkswagen Infotainment for the report.
Assets 4
Loading