From 5d9e709d8563f8d5299cd6297701ae4cd83c9372 Mon Sep 17 00:00:00 2001 From: kaleb-himes Date: Mon, 6 Jun 2022 09:56:02 -0600 Subject: [PATCH] Move vulnerability to it's own section in changelog with attribute to researcher --- ChangeLog.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog.md b/ChangeLog.md index 26f1588a..fcefbe96 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -36,13 +36,15 @@ ## Fixes - Fix for RSA public key auth -- When decoding SFTP messages, fix the size checks so they don't wrap - Fix an issue where the testsuite and echoserver a socket failure - SFTP fix for getting attribute header - Fix for possible null dereference in SendKexDhReply - Remove reference to udp from test.h - Fixes to local port forwarding +## Vulnerabilities +- When processing SFTP messages, wolfSSH isn't checking data lengths against the size of the message and is potentially under-allocating, over-reading, and over-writing buffers. Thank you to Michael Randriananantenaina, an independent security researcher, for the report. + # wolfSSH v1.4.7 (July 23, 2021) ## New Feature Additions and Improvements