GCVE - cpe:2.3:a:yassl:cyassl:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:yassl:cyassl:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Yassl (`966f75e6-0001-5717-811b-f5663afda3de`)
Product	Cyassl (`ef8246da-f016-5449-86dc-5826b061f79e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/cyassl/cyassl`	purl2cpe	2026-06-01 10:15:34.321900
`pkg:github/wolfssl/wolfssl`	purl2cpe	2026-06-01 10:15:34.321902

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2900`	vulnerable	2026-06-08 05:05:30.319611	Details available wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate. Published: 2014-04-22T14:00:00.000Z Updated: 2024-08-06T10:28:46.282Z Open on db.gcve.eu Reference links http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html https://security.gentoo.org/glsa/201612-53 http://seclists.org/oss-sec/2014/q2/126 http://www.securityfocus.com/bid/66780	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2899`	vulnerable	2026-06-08 05:05:30.293025	Details available wolfSSL CyaSSL before 2.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a request for the peer certificate when a certificate parsing failure occurs or (2) a client_key_exchange message when the ephemeral key is not found. Published: 2014-04-22T14:00:00.000Z Updated: 2024-08-06T10:28:46.110Z Open on db.gcve.eu Reference links http://www.wolfssl.com/yaSSL/Blog/Entries/2014/4/11_wolfSSL_Security_Advisory__April_9%2C_2014.html http://www.wolfssl.com/yaSSL/Docs-cyassl-changelog.html https://security.gentoo.org/glsa/201612-53 http://seclists.org/oss-sec/2014/q2/126 http://www.securityfocus.com/bid/66780	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1623`	vulnerable	2026-06-08 05:03:55.054120	Details available The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. Published: 2013-02-08T19:00:00.000Z Updated: 2024-08-06T15:04:49.361Z Open on db.gcve.eu Reference links http://www.isg.rhul.ac.uk/tls/TLStiming.pdf http://openwall.com/lists/oss-security/2013/02/05/24 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.yassl.com/yaSSL/Blog/Entries/2013/2/5_WolfSSL%2C_provider_of_CyaSSL_Embedded_SSL%2C_releases_first_embedded_TLS_and_DTLS_protocol_fix_for_Lucky_Thirteen_Attack.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1558`	vulnerable	2026-06-08 05:00:49.336819	Details available yaSSL CyaSSL before 2.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted X.509 certificate. Published: 2012-03-12T19:00:00.000Z Updated: 2024-08-06T19:01:02.123Z Open on db.gcve.eu Reference links http://secunia.com/advisories/48634 https://exchange.xforce.ibmcloud.com/vulnerabilities/74095 http://www.securityfocus.com/bid/52828 http://www.yassl.com/yaSSL/Docs-cyassl-changelog.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.