mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-12 22:41:33 +02:00
Sameeh JubranandMark Atwood
4ec80d309a
Add tooling to produce Software Bills of Materials and build provenance for wolfSSL, supporting EU Cyber Resilience Act (CRA) obligations. SBOM generation: - New `make sbom` target producing SPDX 2.3 output with NTIA minimum elements, urn:uuid document namespaces, and SPDX LicenseRef compliance. - Reproducible library discovery across autotools and CMake builds, with liboqs recorded as a linked artefact. - Standalone `scripts/gen-sbom` for embedded / RTOS / custom-builder flows that do not use the main build system, plus --srcs-file, --no-artifact-hash, and hash-source options. Build provenance (OmniBOR / bomsh): - End-to-end bomsh tracing of the built binaries with ArtifactID insertion, snapshotting the traced library before libtool relink and hashing the bomsh-traced binary. - `scripts/bomsh_verify.py` to validate provenance against the traced gitoid. Security advisories: - `scripts/gen-advisory` generating CSAF 2.0 and CycloneDX VEX, with a `make` target, VEX overlay schema/example, and CWE name data. Docs, tests, and CI: - doc/SBOM.md and doc/CRA.md, plus README/INSTALL updates. - Unit and regression tests for gen-sbom and gen-advisory. - New sbom.yml and advisory.yml workflows: SPDX validation via pyspdxtools, CSAF validation, bomsh provenance verification, SBOM artifact archiving, macOS coverage, and actions pinned to SHAs. Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
46 lines
2.8 KiB
JSON
46 lines
2.8 KiB
JSON
{
|
|
"_comment": "Human-authored VEX determinations keyed by CVE id. The CVE Program record carries the structural facts (CWE/CVSS/affected ranges); this overlay carries what it cannot express in machine-readable form: the analysis state, the not-affected justification, the response, free-text scope detail, the mainline fixed release version(s), an optional separately-modelled FIPS product entry, and an optional no-cost build-reachability hedge (requires_defines / default_status). The FIPS module_version and cmvp_cert values below are ILLUSTRATIVE placeholders; substitute the real validated module version and CMVP certificate number. gen-advisory folds these into both the CSAF and CycloneDX VEX outputs. requires_defines/default_status are recorded as informational notes only -- this tool does not compute per-build reachability.",
|
|
|
|
"CVE-2026-5501": {
|
|
"state": "exploitable",
|
|
"response": ["update"],
|
|
"detail": "Limited to applications using the OpenSSL compatibility API directly (wolfSSL_X509_verify_cert), such as nginx and haproxy integrations. The native wolfSSL TLS handshake path (ProcessPeerCerts) is not susceptible.",
|
|
"fixed_versions": ["5.9.1"],
|
|
"remediation": "Update to wolfSSL 5.9.1 or later, or avoid relying on wolfSSL_X509_verify_cert in the OpenSSL compatibility layer for chain validation.",
|
|
"fips": {
|
|
"name": "wolfCrypt FIPS 140-3 Module",
|
|
"module_version": "5.2.1",
|
|
"cmvp_cert": "4718",
|
|
"status": "not_affected",
|
|
"justification": "code_not_present",
|
|
"remediation": "No action required for the FIPS-validated module: the affected OpenSSL compatibility layer (wolfSSL_X509_verify_cert) is outside the wolfCrypt FIPS module boundary."
|
|
}
|
|
},
|
|
|
|
"CVE-2026-5778": {
|
|
"state": "exploitable",
|
|
"response": ["update"],
|
|
"detail": "Integer underflow in the ChaCha20-Poly1305 decryption path of the packet sniffer.",
|
|
"requires_defines": ["WOLFSSL_SNIFFER", "HAVE_CHACHA", "HAVE_POLY1305"],
|
|
"default_status": "off",
|
|
"fixed_versions": ["5.9.1"],
|
|
"remediation": "Update to wolfSSL 5.9.1 or later. Builds without --enable-sniffer are not affected.",
|
|
"fips": {
|
|
"name": "wolfCrypt FIPS 140-3 Module",
|
|
"module_version": "5.2.1",
|
|
"cmvp_cert": "4718",
|
|
"status": "not_affected",
|
|
"justification": "code_not_present",
|
|
"remediation": "No action required for the FIPS-validated module: the packet sniffer (src/sniffer.c) is outside the wolfCrypt FIPS module boundary."
|
|
}
|
|
},
|
|
|
|
"CVE-2026-5999": {
|
|
"state": "exploitable",
|
|
"response": ["update"],
|
|
"detail": "Synthetic fixture overlay: a simple mainline-only finding (no separate FIPS product) used to exercise the CVSS v3.1 scores[] path.",
|
|
"fixed_versions": ["5.9.1"],
|
|
"remediation": "Update to wolfSSL 5.9.1 or later."
|
|
}
|
|
}
|