CVE-2021-37155
📋 TL;DR
This vulnerability in wolfSSL allows attackers to bypass OCSP (Online Certificate Status Protocol) validation by providing mismatched serial numbers between requests and responses. This could enable man-in-the-middle attacks where revoked certificates appear valid. Affects systems using wolfSSL 4.6.x through 4.7.x for TLS/SSL connections with OCSP checking enabled.
💻 Affected Systems
- wolfSSL
📦 What is this software?
Wolfssl by Wolfssl
⚠️ Risk & Real-World Impact
Worst Case
Attackers can impersonate legitimate servers using revoked certificates, intercepting and manipulating encrypted traffic in man-in-the-middle attacks.
Likely Case
Attackers bypass certificate revocation checks, allowing use of compromised certificates that should be rejected.
If Mitigated
If OCSP is disabled or alternative revocation methods are used, impact is limited; proper network segmentation reduces attack surface.
🎯 Exploit Status
Exploitation requires man-in-the-middle position and ability to manipulate OCSP traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.0 and later
Vendor Advisory: https://github.com/wolfSSL/wolfssl/releases/tag/v4.8.0-stable
Restart Required: Yes
Instructions:
1. Download wolfSSL 4.8.0 or later from official repository. 2. Replace vulnerable version. 3. Recompile applications using wolfSSL. 4. Restart affected services.
🔧 Temporary Workarounds
Disable OCSP validation
allTemporarily disable OCSP checking in wolfSSL configuration
Configure wolfSSL with --disable-ocsp or set appropriate compile-time flags
Use alternative revocation methods
allSwitch to CRL (Certificate Revocation List) checking instead of OCSP
Configure wolfSSL to use CRL checking via appropriate API calls
🧯 If You Can't Patch
- Implement network segmentation to limit exposure of vulnerable systems
- Deploy network monitoring for unusual certificate validation patterns
🔍 How to Verify
Check if Vulnerable:
Check wolfSSL version: wolfssl_version() returns version string; compare against affected range 4.6.0-4.7.xCheck Version:
wolfssl_version() or check library headersVerify Fix Applied:
Verify version is 4.8.0 or higher and test OCSP validation with mismatched serial numbers📡 Detection & Monitoring
Log Indicators:
- Failed OCSP validations with mismatched serial numbers
- Unexpected successful certificate validations
Network Indicators:
- Unusual OCSP request/response patterns
- Traffic interception attempts
SIEM Query:
Search for wolfSSL version strings 4.6.* or 4.7.* in system logs