CVE-2022-42905

Name	CVE-2022-42905
Description	In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wolfssl (PTS)	bullseye	4.6.0+p1-0+deb11u2	fixed
	bookworm	5.5.4-2+deb12u1	fixed
	trixie	5.6.6-1.2	fixed
	sid	5.6.6-1.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wolfssl	source	bullseye	4.6.0+p1-0+deb11u2
wolfssl	source	(unstable)	5.5.3-1

Fixed in 5.5.2 (https://www.wolfssl.com/docs/security-vulnerabilities/)