Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply Phase 9D security mitigations

Browse Source 
- Add fail-closed wolfSSL small-math policy and vectors
- Backport DHCP, EMS, and X.509 allocation fixes
- Extend source override validation and operational documentation
This commit is contained in:
Commander1024
2026-09-15 23:06:23 +02:00
parent cdc9c7335a
commit c010e1a1d5
22 changed files with 1562 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/wolf_security_review.md
+172
View File
@@ -0,0 +1,172 @@
# Phase 9D — wolfSSL / wolfSSH advisory review (partial)
## Implementation addendum — 2026-09-15
**Xtensa small-math mitigation implemented; the broader review and security sign-off remain open.** Root `CMakeLists.txt` defines `CURVE25519_SMALL` and `ED25519_SMALL` before component parsing. `cmake/wolf_crypto_policy.cmake` propagates a forced-include resolved-settings guard PUBLIC from wolfSSL to consumers, including wolfSSH/application code. `cmake/wolf_crypto_policy.h` requires both enabled small implementations, rejects `WOLFSSL_CURVE25519_BLINDING`, and rejects enabling Curve448/Ed448 without review. This follows PR 9275's small-math policy for the enabled Xtensa algorithms, with consistent library/consumer production flags and ABI-sensitive layouts. **Blinding is not enabled with small X25519**: wolfSSL 5.8.2 excludes/rejects this combination; do not force it back on or present the historical blinding observation below as current policy.
The CVE-2025-12888 configuration mitigation is no longer merely proposed. Supplied parent evidence: `pio run` **PASS**, **94,340 B linked RAM / 1,767,217 B flash**, **−64,092 B flash** from 9C with unchanged linked RAM; all four [focused mitigation commands](security_hardening.md#mitigation-hostbuild-evidence--2026-09-15) passed. Independent reviewer reports SDK-override and wolf-crypto-policy tests passed with no blocking implementation defects. These are supplied host/build results, not reruns by this documentation update, device timing measurements, real SSH interoperability/rekey evidence or runtime-headroom evidence.
**Still pending:** coherent wolfSSH message-order review/correction (CVE-2025-14942), IGNORE/service and other parser review, ECC import/ECDH/raw-signature validation review, remaining advisory applicability, and whole-phase target validation. No dependency upgrades were made; newer release pairs below remain unvalidated candidates. License/source/notice packaging remains unresolved in the [license inventory](dependency_licenses.md). Phase 9 is not complete or production-ready.
## Historical pre-mitigation research baseline — 2026-09-15
**The remainder retains the original research evidence. “Current” macros, generated hashes and “not applied/tested” statements below refer to the earlier non-small snapshot; the addendum supersedes those implementation-status claims only. The pending ordering/parser/ECC findings are not closed.**
Review date: **2026-09-15**. Read-only external research and local applicability inspection; stopped at the user's requested handoff. **Not a completed security review or release clearance.** Only this new report was written. No dependencies, sources, generated inputs, or parent documents were changed; no build, hardware test, network exploit, or public PoC was executed.
## Release decision / current-path priorities
1. **Block security sign-off pending mitigation of CVE-2025-12888.** Current SSH advertises X25519 on Xtensa, and actual compiler preprocessing confirms the affected non-small implementation. Upstream recommends the small implementation; existing blinding is not evidence that this separate compiler/architecture issue is resolved. Exploitability on this precise GCC/optimization/device combination was not measured.
2. **Block sign-off pending a reviewed wolfSSH message-order correction.** CVE-2025-14942 is critical for clients; upstream explicitly recommends its fix for servers because the same defect exists, without identifying a specific server attack. The generated local server state machine lacks the fix. Do **not** report demonstrated server password disclosure or authentication bypass from this evidence.
3. **Close current-path parser gaps before sign-off.** Upstream wolfSSH PR 892 fixes unchecked SSH_IGNORE/service-string parsing still present in the generated source. These are security-relevant malformed-input handling defects, not assigned CVEs in the inspected release notes. Actual out-of-allocation access/exploit impact remains unproven: packet padding and enclosing receive-buffer invariants need auditing. Phase 9C's password fix does not fix these handlers.
4. **Keep ECC validation and other non-CVE hardening open.** Current ECC import lacks `WOLFSSL_VALIDATE_ECC_IMPORT`; 5.9.1 release notes explicitly recommend this flag for older versions. Whether the SSH ECDH path already performs equivalent validation before scalar multiplication was not resolved. Do not call this a confirmed invalid-curve vulnerability.
Smallest proposed mitigation for item 1: enable `CURVE25519_SMALL` consistently for library and consumers through project-owned compile policy; upstream PR 9275 also enables `ED25519_SMALL`, `CURVE448_SMALL`, and `ED448_SMALL` on Xtensa. For enabled algorithms, follow that upstream policy rather than assume X25519 blinding suffices. Check the effective blinding/small combination, ABI, compile guards, performance, and real SSH interoperability. This was **not applied or tested**.
Item 2 is **not a safe one-line patch**. PR 855 changes `internal.c`, handshake layout in `wolfssh/internal.h`, message ranges, expected-message tracking, and logging; 1.4.20 also predates intervening rekey changes. A backport needs the coherent library/header change set, audit of prerequisites, and later PR 921 follow-up noted in 1.5.0. Prefer evaluating **wolfSSH 1.5.0 + wolfSSL 5.9.2**, the newest stable releases returned by the queried APIs, rather than merely reaching the minimum fixed release. This is a candidate pair, **not verified ESP managed-component availability or compatibility**. Any upgrade requires rebasing exact-hash Phase 9C overrides, auth/version guards, callback changes (including keyboard auth), and contract tests; do not blindly repin.
For item 3 the smallest candidate backport is the bounded `GetSkip`/`GetString` handling from PR 892, including necessary helper semantics, plus regression cases for truncated/oversized/wrapping lengths. Preserve Phase 9C password framing and wiping. No backport has been proven safe by this report.
## Local evidence and effective policy
- `dependencies.lock`: `wolfssl/wolfssl` **5.8.2~1** (upstream **5.8.2**), component hash `4d619e882c19d967bbaa53302e3bd2bdb8c611b5efb13302171aace809fccfdf`; `wolfssl/wolfssh` **1.4.20**, component hash `24d623360c07374a90b1ade8d1218b24bb7b661fd51ace9135dccf510a338927`.
- Actual database: `.pio/build/esp32-s3-devkitc-1-n16r8/compile_commands.json`. Replayed four actual compiler commands with `-E -dM`, removing compilation/output/dependency-write flags, capturing stdout only: wolfCrypt `ecc.c`, `curve25519.c`, `random.c`, and generated wolfSSH `security_overrides/wolfssh_internal/internal.c`. All four preprocessing invocations returned 0. This is current compile-policy evidence, not proof the flashed binary matches it.
- Compiler: `xtensa-esp32s3-elf-gcc`, `__GNUC__=14`, `__GNUC_MINOR__=2`, `__XTENSA__=1`; representative wolfCrypt commands use **`-Og`**.
- Generated wolfSSH input SHA-256: `1c04d26d46f7bef61eefcf0b78c43742662001bf6054ad2383500c9063c62494`. `tools/security_overrides.py` pins original `internal.c` SHA-256 `81ff1f9166708abd5c2911e9fe57c0aee01c88b5d3f68c909ee8a856d37f36a9`; edits bound both password lengths with `GetSize`, prevent malformed new-password framing reaching the callback, and wipe the checked method suffix. No message-order or IGNORE/service parsing correction appears in those edits.
- `src/ssh_protocol_policy.c`: KEX `curve25519-sha256,ecdh-sha2-nistp256`; host key `ecdsa-sha2-nistp256`; ciphers AES-128/256-GCM; MAC advertisement HMAC-SHA256; user-key advertisement Ed25519/P256. Database authorization remains separate from advertisement.
- `src/ssh_transport.c`: creates `WOLFSSH_ENDPOINT_SERVER`; sets authentication callbacks, explicit keyboard rejection, shell acceptance, and exec/subsystem rejection. Project memory identifies wolfCrypt as SSH crypto, **not the HTTPS provider**. However, **`WOLFCRYPT_ONLY` and `NO_TLS` are absent** in the actual macros: “used only for crypto” must not be mislabeled “TLS compiled out.” No duplicate IDF/mbedTLS advisory assessment is made here.
| Area | Effective observations | Consequence |
| --- | --- | --- |
| Math | `USE_FAST_MATH` present; `WOLFSSL_SP_MATH`, `WOLFSSL_SP_MATH_ALL`, `WOLFSSL_HAVE_SP_ECC`, `WOLFSSL_HAVE_SP_DH`, `WOLFSSL_SP_NONBLOCK` absent | TFM, not SP. SP-specific release fixes are not automatically current-path findings. |
| DH | `NO_DH` present; generated SSH also has `WOLFSSH_NO_DH` | Finite-field DH and SSH DH-GEX fixes are not current negotiated features. ECDH is distinct and remains enabled. |
| ECC | `HAVE_ECC`, `ECC_TIMING_RESISTANT`, `HAVE_ECC_CHECK_KEY` present; `WOLFSSL_VALIDATE_ECC_IMPORT`, `USE_ECC_B_PARAM` absent; `HAVE_ECC_CHECK_PUBKEY_ORDER` appears in `ecc.c` after its internal includes | A compiled key-check implementation is not proof callers invoke it. `ecc.c:10993–10996` gates import-time checking on the absent validation flag. |
| X25519 / Ed25519 | `HAVE_CURVE25519`, `HAVE_ED25519`, `WOLFSSL_CURVE25519_BLINDING` present; `CURVE25519_SMALL`, `ED25519_SMALL` absent | CVE-2025-12888 configuration matches; earlier blinding hardening is enabled. |
| RNG | `HAVE_HASHDRBG`, `WC_RNG_SEED_CB` present; custom generate-block/seed macros absent; `wc_SetSeed_Cb(ssh_seed)` registration observed | Project callback supplies wolfCrypt Hash-DRBG seeding. Do not confuse this with OpenSSL RAND-after-fork or claim entropy quality was tested. |
| AES / hardware | `HAVE_AESGCM` present; streaming GCM absent; ESP32 crypto port present, hardware AES/hash explicitly disabled; RSA hardware-disable macro absent | Current AES/hash software policy is intentional. Not an all-software-crypto claim. |
| Optional APIs | `HAVE_PKCS7`, `HAVE_ECCSI`, `HAVE_CHACHA`, `HAVE_XCHACHA`, `HAVE_POLY1305`, `OPENSSL_EXTRA` absent; ASN template present/original absent | Many crypto-only advisories still need feature/API filtering, not just TLS exclusion. |
| SSH features | `WOLFSSH_CERTS`, `WOLFSSH_SFTP`, `WOLFSSH_SCP`, `WOLFSSH_FWD`, `WOLFSSH_AGENT` absent; `NO_WOLFSSH_CLIENT` absent | No certificate/file-transfer/forwarding feature; client code not compile-disabled, but inspected application is server-only. |
## Priority advisory evidence table
Dates below are CVE record **publication dates (UTC)**, not reservation or release dates. Upstream severity does not by itself establish local exploitability. Source URLs are listed below.
| ID / upstream severity | Published | Affected / fixed upstream | Local applicability and evidence |
| --- | --- | --- | --- |
| **CVE-2025-12888 / Low** | 2025-11-21 | `<5.8.4`; fixed 5.8.4, wolfSSL PR 9275 | **Applicable configuration, immediate mitigation priority.** Xtensa + advertised X25519 + small implementation absent. Patch inspected. |
| **CVE-2025-14942 / Critical (client)** | 2026-01-06 | `<1.4.22`; fixed 1.4.22, wolfSSH PR 855 | **Potential server impact / upstream recommends server fix.** Generated `internal.c:587–623` has old accept-state filtering, no expected-message tracking. Critical client credential-leak scenario is not this application's role. |
| CVE-2025-11625 / Critical | 2025-10-21 | `<=1.4.20` client; fixed 1.4.21, PR 840 | **Not current role.** Host-verification bypass/credential leak concerns wolfSSH clients. CNA version string is malformed (`1.4.20;0`); range taken from official release notes. |
| CVE-2025-11624 / Medium | 2025-10-21 | 1.3.0–1.4.20 inclusive; fixed 1.4.21, PR 834 | **Not current feature.** SFTP file-handle stack overflow; SFTP absent. |
| CVE-2025-15382 / Medium | 2026-01-06 | Release notes: 1.4.12–1.4.21 inclusive; fixed 1.4.22, PR 859 | **Not current feature.** SCP clean-path overread. CNA incorrectly/differently says `<1.4.21`; use conservative release-note range and retain discrepancy. |
| CVE-2026-0930 / Low | 2026-04-20 | 1.4.15–`<1.5.0`; fixed 1.5.0 | **Not current platform/application.** Windows wolfSSHd terminal resize. Release notes name PR 864; CNA references PR 846 instead. Discrepancy not resolved. |
| CVE-2026-5194 / Critical | 2026-04-09 | 3.12.0–`<5.9.1`; fixed 5.9.1, wolfSSL PR 10131 | **Not demonstrated on current SSH flow.** Certificate OID/type confusion absent without SSH certificates. Patch also hardens low-level ECC digest lengths, so crypto-only use is not a blanket exclusion. Inspected SSH paths derive digest sizes from hash IDs; finish tracing every current raw-signature call before closure. |
| CVE-2026-5187 / Low | 2026-04-09 | `<=5.9.0`; fixed 5.9.1, PR 10025 | **No current trigger established.** `DecodeObjectId`/unknown ASN.1 extension handling; raw SSH keys are not X.509 extensions. ASN is compiled for keys/signatures, so retain API reachability check rather than claim all ASN parsing absent. |
| CVE-2025-13912 / Low | 2025-12-11 | `<5.8.4`; fixed 5.8.4, PR 9148 | **Not reported compiler/architecture combination.** Advisory describes Clang on AArch64/RISC-V/x86_64; current GCC14.2 Xtensa. Separate from CVE-2025-12888. |
| CVE-2025-7396 / Low | 2025-07-18 | Blinding introduced 5.8.0, enabled by default in applicable 5.8.2 builds | **Existing mitigation present:** actual `WOLFSSL_CURVE25519_BLINDING`. CNA affected string `5.8.0; 0` is not a usable precise range. Not a resolution of the Xtensa advisory. |
## Post-pin release review, including changes without CVEs
| Product / version | Release-note date / GitHub publication UTC date | Scope checked |
| --- | --- | --- |
| wolfSSL 5.8.4 | 2025-11-20 / 2025-11-21 | Xtensa small implementations, Clang hardening, TLS advisories, ESP SHA changes. |
| wolfSSL 5.9.0 | 2026-03-18 / 2026-03-19 | TLS/PKCS/CRL advisories; RISC-V SP timing, KCAPI ECC import, RNG/port changes. |
| wolfSSL 5.9.1 | 2026-04-08 / 2026-04-08 | Certificate/digest checks; ECC import validation; SP and hardware-port hardening. |
| wolfSSL 5.9.2 | 2026-06-23 / 2026-06-25 | Latest stable returned; additional crypto validation, zeroization, SP/DH, PKCS, TLS and platform fixes. Unreleased master material is not a release candidate. |
| wolfSSH 1.4.21 | 2025-10-20 / 2025-10-22 | Client/SFTP CVEs; rekey PR 793, auth rejection fixes, keyboard callback changes. |
| wolfSSH 1.4.22 | 2026-01-05 / 2026-01-06 | State-machine/SCP CVEs; PRs 854 auth initialization, 857 string parsing, 856 worker/backpressure. |
| wolfSSH 1.5.0 | 2026-04-17 / 2026-04-20 | Latest stable returned; parser/bounds, callback defaults, key cleanup, KEX ordering, Windows CVE. |
Non-CVE findings are not automatically less important:
- **wolfSSH PR 892 (fixed in 1.5.0):** actual generated `DoIgnore` at line 5912 reads its length with unchecked `ato32`, ignores `len`, and advances by an unchecked peer length. `DoServiceRequest` at line 6124 also reads before checking; later service-name check does not establish four readable input bytes. Patch replaces these with bounded helpers. Password portion is already locally corrected, but the entire PR is not present.
- **wolfSSH PR 881 (1.5.0):** patch adds overflow check before `peerWindowSz += bytesToAdd`. Patch inspected; exact local function comparison was not completed. Potential availability/correctness issue, not a confirmed buffer overflow.
- **wolfSSH PR 899 (1.5.0):** patch bounds skips in `ParseRSAPubKey`/`ParseECCPubKey` and corrects `DoChannelFailure` length validation. Current role/reachability not finished; do not conflate client host-key parsing with server user-key authentication.
- **wolfSSH PR 880 (1.5.0):** release notes describe public-key type validation logical-operator correction. Actual generated `DoUserAuthRequestEcc` contains length mismatch **AND** `memcmp` mismatch checks for both key and signature type. This needs focused review with database key matching and attacker signature framing; exploit impact not established. Terminal-mode, agent, TPM, daemon changes in that PR need separate feature filtering.
- **wolfSSH PRs 918/919/902 (1.5.0):** forwarding/channel callback and payload hardening. FWD is absent; shell/exec/subsystem callbacks are registered, but default channel-open handling is not fully audited. No forwarding bypass claim.
- **wolfSSL PR 10133 (5.9.1):** ECC validation hardening. Actual `wc_ecc_import_x963_ex` calls `wc_ecc_check_key` only under absent `WOLFSSL_VALIDATE_ECC_IMPORT`. `HAVE_ECC_CHECK_PUBKEY_ORDER` is present inside `ecc.c`; its validation implementation can load curve B even without `USE_ECC_B_PARAM`. Do not infer “no point check anywhere” merely from absent B macro. Smallest candidate hardening is the upstream-recommended validation flag, pending full ECDH call trace and cost tests.
- **wolfSSL 5.9.2:** SP integer fixes, P521 SP ECDH 65/66-byte output check (PR 10702), DH subgroup hardening (PR 10560) are not current TFM/P256/no-DH features. Curve25519 all-zero-secret default checking (PR 10374), private-key clamp check (PR 10363), and broader ECC/EdDSA zeroization/validation fixes warrant follow-up. ESP port fixes in 5.9.1 PRs 10003/10080 need per-backend review; AES/hash hardware is disabled but that does not eliminate every ESP port path.
## Remaining wolfSSL CVE inventory collected
All identifiers in this section have the prefix **CVE-**. Ranges are CNA metadata, not proof of local reachability; `0` means the record supplied no meaningful historical lower bound. Every listed record was successfully queried at `https://cveawg.mitre.org/api/cve/<full-ID>`. Fixed versions and trigger descriptions came from the official security page and ChangeLog. This is a compact screening inventory, **not completed per-patch validation**.
| IDs | Published | Affected range / fixed | Current-feature screening |
| --- | --- | --- | --- |
| 2025-11931 | 2025-11-21 | `<5.8.4` / 5.8.4 | XChaCha API absent. |
| 2025-11932, 2025-12889 | 2025-11-21 | `<5.8.4` / 5.8.4 | wolfSSL TLS PSK/digest policy not used. |
| 2025-11933, 2025-11934, 2025-11935, 2025-11936 | 2025-11-21 | `[3.12.0,5.8.4)` / 5.8.4 | wolfSSL TLS1.3 not used. |
| 2026-0819 | 2026-03-19 | `[5.5.0,5.9.0)` / 5.9.0 | PKCS7 absent. |
| 2026-1005, 2026-2646 | 2026-03-19 | `<=5.8.4` / 5.9.0 | No wolfSSL sniffer/session restore use. |
| 2026-2645 | 2026-03-19 | `<5.8.4` / 5.8.4; further 5.9.0 hardening | wolfSSL TLS1.2 server not used; table headline 5.9.0 must not obscure earlier effective fix. |
| 2026-3229, 2026-3230, 2026-3547, 2026-3548, 2026-3549 | 2026-03-19 | `<5.9.0` / 5.9.0 | Compatibility certificate APIs/TLS/CRL not current SSH features. |
| 2026-3503 | 2026-03-19 | `[5.8.2,5.9.0)` / 5.9.0 | ARM Cortex-M PQ fault attack; wrong platform/features. |
| 2026-3579, 2026-3580 | 2026-03-19 | `<5.9.0` / 5.9.0 | RISC-V RV32I SP timing; wrong platform/math. |
| 2026-3849 | 2026-03-19 | 5.6.0–5.8.4 inclusive / 5.9.0 | HPKE/ECH TLS client not used. |
| 2026-4159, 2026-4395 | 2026-03-19 | `<5.9.0`; `<=5.8.4`, respectively / 5.9.0 | PKCS7 / Linux KCAPI ECC not current features. |
| 2026-5188 | 2026-04-10 | `<=5.9.0` / 5.9.1 | Original ASN SAN parser; current template parser, no SSH certificates. |
| 2026-5263, 2026-5264, 2026-5295, 2026-5392, 2026-5393, 2026-5447, 2026-5448, 2026-5460 | 2026-04-09 | `<5.9.1` / 5.9.1 | Certificate constraints, DTLS, PKCS7, experimental dual certs, compatibility APIs or TLS PQ paths not used. |
| 2026-5446 | 2026-04-09 | `[5.2.1,5.9.1)` / 5.9.1 | ARIA TLS not used. |
| 2026-5466, 2026-5479 | 2026-04-10 | `<5.9.1` / 5.9.1 | ECCSI / EVP ChaCha absent. |
| 2026-5477, 2026-5500, 2026-5501 | 2026-04-10 | `<=5.9.0` / 5.9.1 | EAX/CMAC >4GiB, PKCS7, compatibility X509 not used. |
| 2026-5503, 2026-5504, 2026-5507, 2026-5772, 2026-5778 | 2026-04-09 | `<=5.9.0` / 5.9.1 | ECH, PKCS7, session restore, hostname matcher, sniffer not used. |
| 2026-10097 | 2026-06-25 | `[5.7.0,5.9.1]` / 5.9.2 | AVX2 ML-KEM; wrong platform/feature. |
| 2026-10098 | 2026-06-25 | `[4.6.0,5.9.1]` / 5.9.2 | OCSP not used. |
| 2026-10512 | 2026-06-25 | `[5.6.4,5.9.1]` / 5.9.2 | X25519 x86_64 assembly; wrong implementation. |
| 2026-10592, 2026-6731, 2026-6412 | 2026-06-25 | `[3.9.10,5.9.1]` / 5.9.2 | Certificate name constraints/digest policy not current feature. |
| 2026-11310 | 2026-06-25 | `[5.8.4,5.9.1]` / 5.9.2 | Pin predates introduction; compatibility X509 absent. |
| 2026-11703 | 2026-06-25 | `[3.15.0,5.9.1]` / 5.9.2 | TLS SNI/ALPN resumption not used. |
| 2026-11999, 2026-6091, 2026-55964 | 2026-06-25 | `[5.7.4,5.9.1]` / 5.9.2 | Certificate path verification not current feature. |
| 2026-12340, 2026-55960 | 2026-06-25 | `[5.6.4,5.9.1]` / 5.9.2 | SM2 certificate/RPK TLS not used. |
| 2026-55958 | 2026-06-25 | `[5.4.0,5.9.1]` / 5.9.2 | Renesas TSIP TLS; wrong platform. |
| 2026-55961 | 2026-06-25 | `[3.15.7,5.9.1]` / 5.9.2 | Compatibility PKCS7 absent. |
| 2026-55962 | 2026-06-25 | `[5.5.4,5.9.1]` / 5.9.2 | TLS post-handshake authentication not used. |
| 2026-55967 | 2026-06-25 | `[4.8.0,5.9.1]` / 5.9.2 | GCM streaming >64GiB per message; streaming absent, not cumulative SSH session traffic. |
| 2026-6092 | 2026-06-25 | `[5.2.0,5.9.1]` / 5.9.2 | TLS Encrypt-then-MAC not used. |
| 2026-6094, 2026-7531 | 2026-06-25 | `[5.8.0,5.9.1]` / 5.9.2 | PKCS7 / TLS PQ hybrid not used. |
| 2026-6291 | 2026-06-25 | `[3.9.10,5.9.1]` / 5.9.2 | PKCS7 RSA padding oracle, not SSH raw key authentication. |
| 2026-6325 | 2026-06-25 | `[4.8.0,5.9.1]` / 5.9.2 | TLS signature-list setup not used. |
| 2026-6329 | 2026-06-25 | `[3.10.0,5.9.1]` / 5.9.2 | PKCS12 MAC verification not a current SSH workflow. |
| 2026-6330 | 2026-06-25 | `[5.7.4,5.9.1]` / 5.9.2 | ARM64 ML-KEM; wrong platform/feature. |
| 2026-6331, 2026-6678, 2026-7511 | 2026-06-25 | `[3.15.5,5.9.1]` / 5.9.2 | EVP HMAC / PKCS7 APIs not used. |
| 2026-6450 | 2026-06-25 | `[4.3.0,5.9.1]` / 5.9.2 | CRL not used. |
| 2026-6679 | 2026-06-25 | `[5.4.0,5.9.0]` / 5.9.1 | DTLS not used. Listed under 5.9.2 but narrative says already fixed 5.9.1. |
| 2026-6681 | 2026-06-25 | `[3.10.0,5.9.0]` / 5.9.1 | PKCS7 absent; same release-table/narrative discrepancy. |
| 2026-7532 | 2026-06-25 | `<=5.9.1` / 5.9.2 | X509 IP constraints not used. Related advisory ID TALOS-2026-2409 appears in upstream ChangeLog; Talos page not queried. |
| 2026-8720 | 2026-06-25 | `[5.9.0,5.9.1]` / 5.9.2 | HMAC-BLAKE2 APIs introduced after pin. |
## Queried sources and caveats
All following requests occurred during this **2026-09-15** review. Network requests succeeded; no blocked-network limitation applies to collected external evidence. The last attempted local read/status command failed with `authorization channel closed`; no final repository status/diff validation was obtained.
Official index and release sources fetched:
- https://www.wolfssl.com/docs/security-vulnerabilities/
- https://github.com/wolfSSL/wolfssh/releases
- https://raw.githubusercontent.com/wolfSSL/wolfssh/master/ChangeLog.md
- https://raw.githubusercontent.com/wolfSSL/wolfssl/master/ChangeLog.md
- https://api.github.com/repos/wolfSSL/wolfssl/releases?per_page=6
- https://api.github.com/repos/wolfSSL/wolfssh/releases?per_page=6
Patch URLs actually queried (read only; no patch applied):
- https://github.com/wolfSSL/wolfssl/pull/9275.diff
- https://github.com/wolfSSL/wolfssl/pull/10131.diff
- https://github.com/wolfSSL/wolfssl/pull/10133.diff
- https://github.com/wolfSSL/wolfssl/pull/10025.diff
- https://github.com/wolfSSL/wolfssh/pull/855.diff
- https://github.com/wolfSSL/wolfssh/pull/892.diff
- https://github.com/wolfSSL/wolfssh/pull/881.diff
- https://github.com/wolfSSL/wolfssh/pull/899.diff
CVE metadata: exact URL construction is `https://cveawg.mitre.org/api/cve/` followed by each full CVE identifier in the priority table and inventory above. Every such ID was queried; some twice. These are vendor CNA records served by the CVE API. Full paths are mechanically recoverable without search, e.g. https://cveawg.mitre.org/api/cve/CVE-2025-12888 and https://cveawg.mitre.org/api/cve/CVE-2025-14942 . No NVD or GitHub advisory API query was made.
Additional upstream patch links **identified in release notes, not fetched**: wolfSSH [840](https://github.com/wolfSSL/wolfssh/pull/840), [834](https://github.com/wolfSSL/wolfssh/pull/834), [859](https://github.com/wolfSSL/wolfssh/pull/859), [864](https://github.com/wolfSSL/wolfssh/pull/864), [793](https://github.com/wolfSSL/wolfssh/pull/793), [854](https://github.com/wolfSSL/wolfssh/pull/854), [856](https://github.com/wolfSSL/wolfssh/pull/856), [857](https://github.com/wolfSSL/wolfssh/pull/857), [880](https://github.com/wolfSSL/wolfssh/pull/880), [902](https://github.com/wolfSSL/wolfssh/pull/902), [918](https://github.com/wolfSSL/wolfssh/pull/918), [919](https://github.com/wolfSSL/wolfssh/pull/919), [921](https://github.com/wolfSSL/wolfssh/pull/921); wolfSSL [9148](https://github.com/wolfSSL/wolfssl/pull/9148), [10003](https://github.com/wolfSSL/wolfssl/pull/10003), [10080](https://github.com/wolfSSL/wolfssl/pull/10080), [10363](https://github.com/wolfSSL/wolfssl/pull/10363), [10374](https://github.com/wolfSSL/wolfssl/pull/10374), [10560](https://github.com/wolfSSL/wolfssl/pull/10560), [10702](https://github.com/wolfSSL/wolfssl/pull/10702).
Evidence limitations:
- The consolidated official page omitted the four wolfSSH CVEs published with 1.4.21/1.4.22 despite listing older and newer entries. **Neither that omission nor the user's earlier empty GitHub advisory tabs proves absence of vulnerabilities.** GitHub advisory tabs were not re-queried here.
- Release-note dates differ from GitHub publication dates. CNA metadata has malformed ranges and conflicting references as noted. No date was inferred from a CVE year.
- Master ChangeLogs and PR diffs are mutable. Release tags/timestamps were queried, but upstream full commit hashes and archived evidence snapshots were not captured. Some long patch responses were output-limited; do not interpret a successful fetch as a complete hunk-by-hunk audit.
- Macro evidence is stronger than default Kconfig assumptions but not disassembly/timing evidence. Whole-library API reachability/linker elimination, every math/port fix, low-order X25519 behavior, RNG error paths, and ECC validation call chains remain unfinished.
- Older entries such as wolfSSH CVE-2024-2873 (fixed 1.4.17) were visible in the index; this report is focused on post-pin maintenance and does not certify every historical advisory.
- Parent follow-up: resolve the current-path priorities, choose a coherent upgrade/backport strategy, add negative message-order/parser/key-validation tests against actual generated sources, and run firmware plus whole-Phase-9 hardware gates. No hardware evidence is implied here.