CVE-2025-7395

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7395", "assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "state": "PUBLISHED", "assignerShortName": "wolfSSL", "dateReserved": "2025-07-09T16:38:39.054Z", "datePublished": "2025-07-18T22:15:59.460Z", "dateUpdated": "2025-07-21T14:56:52.762Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS", "iOS", "watchOS", "tvOS", "iPadOS"], "product": "wolfSSL", "programFiles": ["src/internal.c"], "repo": "https://github.com/wolfSSL/wolfssl", "vendor": "wolfSSL", "versions": [{"lessThanOrEqual": "5.8.0", "status": "affected", "version": "5.6.4", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Building with WOLFSSL_APPLE_NATIVE_CERT_VALIDATION"}], "value": "Building with WOLFSSL_APPLE_NATIVE_CERT_VALIDATION"}], "credits": [{"lang": "en", "type": "finder", "value": "Thomas Leong"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate's domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname. <br>"}], "value": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate's domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname."}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/V:D/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "shortName": "wolfSSL", "dateUpdated": "2025-07-18T22:15:59.460Z"}, "references": [{"url": "http://github.com/wolfssl/wolfssl.git"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to wolfSSL commit fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer"}], "value": "Upgrade to wolfSSL commit fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer"}], "source": {"discovery": "EXTERNAL"}, "title": "Domain Name Validation Bypass with Apple Native Certificate Validation", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Manually load CA certificates into wolfSSL instead of relying on apple native certificate verification, or upgrade to wolfSSL commit&nbsp;fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer</div>"}], "value": "Manually load CA certificates into wolfSSL instead of relying on apple native certificate verification, or upgrade to wolfSSL commit\u00a0fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-21T14:56:37.968146Z", "id": "CVE-2025-7395", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T14:56:52.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-21T14:56:37.968146Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T14:56:45.588Z"}}], "cna": {"title": "Domain Name Validation Bypass with Apple Native Certificate Validation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Thomas Leong"}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/V:D/U:Red", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/wolfSSL/wolfssl", "vendor": "wolfSSL", "product": "wolfSSL", "versions": [{"status": "affected", "version": "5.6.4", "versionType": "semver", "lessThanOrEqual": "5.8.0"}], "platforms": ["MacOS", "iOS", "watchOS", "tvOS", "iPadOS"], "programFiles": ["src/internal.c"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to wolfSSL commit fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer", "supportingMedia": [{"type": "text/html", "value": "Upgrade to wolfSSL commit fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer", "base64": false}]}], "references": [{"url": "http://github.com/wolfssl/wolfssl.git"}], "workarounds": [{"lang": "en", "value": "Manually load CA certificates into wolfSSL instead of relying on apple native certificate verification, or upgrade to wolfSSL commit\u00a0fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer", "supportingMedia": [{"type": "text/html", "value": "<div>Manually load CA certificates into wolfSSL instead of relying on apple native certificate verification, or upgrade to wolfSSL commit&nbsp;fbc483e23a3e42d5430a838230db1f8c90b88d41 or newer</div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate's domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.", "supportingMedia": [{"type": "text/html", "value": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate's domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname. <br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "configurations": [{"lang": "en", "value": "Building with WOLFSSL_APPLE_NATIVE_CERT_VALIDATION", "supportingMedia": [{"type": "text/html", "value": "Building with WOLFSSL_APPLE_NATIVE_CERT_VALIDATION", "base64": false}]}], "providerMetadata": {"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "shortName": "wolfSSL", "dateUpdated": "2025-07-18T22:15:59.460Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7395", "state": "PUBLISHED", "dateUpdated": "2025-07-21T14:56:52.762Z", "dateReserved": "2025-07-09T16:38:39.054Z", "assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "datePublished": "2025-07-18T22:15:59.460Z", "assignerShortName": "wolfSSL"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["MacOS", "iOS", "watchOS", "tvOS", "iPadOS"], "product": "wolfSSL", "programFiles": ["src/internal.c"], "repo": "https://github.com/wolfSSL/wolfssl", "vendor": "wolfSSL", "versions": [{"lessThanOrEqual": "5.8.0", "status": "affected", "version": "5.6.4", "versionType": "semver"}]}], "source": "facts@wolfssl.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate's domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname."}, {"lang": "es", "value": "Un error de verificaci\u00f3n de certificado en wolfSSL al compilar con las opciones WOLFSSL_SYS_CA_CERTS y WOLFSSL_APPLE_NATIVE_CERT_VALIDATION da como resultado que el cliente wolfSSL no verifique correctamente el nombre de dominio del certificado del servidor, lo que permite que se acepte cualquier certificado emitido por una CA confiable independientemente del nombre de host."}], "id": "CVE-2025-7395", "lastModified": "2026-06-17T10:04:51.813", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "facts@wolfssl.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7395", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-21T14:56:37.968146Z", "version": "2.0.3"}}]}, "published": "2025-07-18T23:15:23.657", "references": [{"source": "facts@wolfssl.com", "url": "http://github.com/wolfssl/wolfssl.git"}], "sourceIdentifier": "facts@wolfssl.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "facts@wolfssl.com", "type": "Secondary"}]}

{}

{"created": "2025-07-21T15:17:07.175176+00:00", "updated": "2025-07-21T15:17:07.175227+00:00", "vendors": ["wolfssl", "wolfssl$PRODUCT$wolfssl"]}