Description (CNA)
When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wolfSSL / wolfSSL | affected 0 through 5.9.0 |
CWE
CWE-502
References
ADP enrichment
No English description supplied.
No references supplied.