Log Message:
security/wolfssl: Update to 5.6.6

Changes since 5.6.4:

wolfSSL Release 5.6.6 (Dec 19, 2023)

NOTE: * --enable-heapmath is being deprecated and will be removed by 2024

REMINDER: When working with AES Block Cipher algorithms, wc_AesInit() should
always be called first to initialize the Aes structure, before calling other
Aes API functions. Recently we found several places in our documentation,
comments, and codebase where this pattern was not observed. We have since
fixed this omission in several PRs for this release.

Vulnerabilities

  * [Medium] CVE-2023-6935: After review of the previous RSA timing fix in
    wolfSSL 5.6.4, additional changes were found to be required. A complete
    resistant change is delivered in this release. This fix is for the Marvin
    attack, leading to being able to decrypt a saved TLS connection and
    potentially forge a signature after probing with a very large number of
    trial connections. This issue is around RSA decryption and affects the
    optional static RSA cipher suites on the server side, which are considered
    weak, not recommended to be used and are off by default in wolfSSL (even
    with --enable-all). Static RSA cipher suites were also removed from the
    TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding
    versions of RSA decrypt are affected since the code under review is
    outside of the padding processing. Information about the private keys is
    NOT compromised in affected code. It is recommended to disable static RSA
    cipher suites and update the version of wolfSSL used if using RSA private
    decryption alone outside of TLS. Thanks to Hubert Kario for the report.
    The fix for this issue is located in the following GitHub Pull Request:
    #6955.

  * [Low] CVE-2023-6936: A potential heap overflow read is possible in servers
    connecting over TLS 1.3 when the optional WOLFSSL_CALLBACKS has been
    defined. The out of bounds read can occur when a server receives a
    malicious malformed ClientHello. Users should either discontinue use of
    WOLFSSL_CALLBACKS on the server side or update versions of wolfSSL to
    5.6.6. Thanks to the tlspuffin fuzzer team for the report which was
    designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer
    (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is
    located in the following GitHub Pull Request: #6949.

  * [Low] A side channel vulnerability with AES T-Tables is possible in a very
    controlled environment where precision sub-cache-line inspection can
    happen, such as inside an Intel SGX enclave. This can lead to recovery of
    the AES key. To prevent this type of attack, wolfSSL added an AES
    bitsliced implementation which can be enabled with the
    "--enable-aes-bitsliced" configure option. Thanks to Florian Sieck,
    Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas
    Eisenbarth, and Yuval Yarom for the  report (Universities of Lübeck,
    Melbourne, Adelaide and Bochum). The fix for this issue is located in the
    following GitHub Pull Request: #6854.

  * [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in
    a single (D)TLS record do not span key boundaries. As a result, it was
    possible to combine (D)TLS messages using different keys into one (D)TLS
    record. The most extreme edge case is that, in (D)TLS 1.3, it was possible
    that an unencrypted (D)TLS 1.3 record from the server containing first a
    ServerHello message and then the rest of the first server flight would be
    accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted
    after the ServerHello but a wolfSSL client would accept an unencrypted
    flight from the server. This does not compromise key negotiation and
    authentication so it is assigned a low severity rating. Thanks to Johannes
    Wilson for the report (Sectra Communications and Linköping University).
    The fix for this issue is located in the following GitHub Pull Request:
    #7029.

New Feature Additions

  * Build option for disabling CRL date checks (WOLFSSL_NO_CRL_DATE_CHECK)
    (PR 6927)
  * Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
  * Add option to skip cookie exchange on DTLS 1.3 session resumption
    (PR 6929)
  * Add implementation of SRTP KDF and SRTCP KDF (--enable-srtp-kdf) (PR 6888)
  * Add wolfSSL_EXTENDED_KEY_USAGE_free() (PR 6916)
  * Add AES bitsliced implementation that is cache attack safe
    (--enable-aes-bitsliced) (PR 6854)
  * Add memcached support and automated testing (PR 6430, 7022)
  * Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2
    (PR 6990)
  * Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)

Enhancements and Optimizations

  * Better built in testing of “--sys-ca-certs” configure option (PR 6910)
  * Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877)
  * Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled)
    (PR 6946)
  * Add “--enable-quic” to “--enable-all” configure option (PR 6957)
  * Add support to SP C implementation for RSA exponent up to 64-bits
    (PR 6959)
  * Add result of “HAVE___UINT128_T” to options.h for CMake builds (PR 6965)
  * Add optimized assembly for AES-GCM on ARM64 using hardware crypto
    instructions (PR 6967)
  * Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952)
  * Add wolfCrypt test and unit test to ctest (PR 6977)
  * Move OpenSSL compatibility crypto APIs into ssl_crypto.c file (PR 6935)
  * Validate time generated from XGMTIME() (PR 6958)
  * Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868)
  * Add GitHub Actions testing with nginx 1.24.0 (PR 6982)
  * Allow encoding of CA:FALSE BasicConstraint during cert generation
    (PR 6953)
  * Add CMake option to enable DTLS-SRTP (PR 6991)
  * Add CMake options for enabling QUIC and cURL (PR 7049)
  * Improve RSA blinding to make code more constant time (PR 6955)
  * Refactor AES-NI implementation macros to allow dynamic fallback to C
    (PR 6981)
  * Default to native Windows threading API on MinGW (PR 7015)
  * Return better error codes from OCSP response check (PR 7028)
  * Updated Espressif ESP32 TLS client and server examples (PR 6844)
  * Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips
    (PR 7035, 7037)
  * Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
  * Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
  * Simplify and improve apple-universal build script (PR 7025)

Fixes

  * Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931)
  * Fix for building PKCS#7 with RSA disabled (PR 6902)
  * Fix for advancing output pointer in wolfSSL_i2d_X509() (PR 6891)
  * Fix for EVP_EncodeBlock() appending a newline (PR 6900)
  * Fix for wolfSSL_RSA_verify_PKCS1_PSS() with RSA_PSS_SALTLEN_AUTO (PR 6938)
  * Fixes for CODESonar reports around isalpha() and isalnum() calls (PR 6810)
  * Fix for SP ARM64 integer math to avoid compiler optimization issues
    (PR 6942)
  * Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971)
  * Fix for SP Thumb2 to make functions not inlined (PR 6993)
  * Fix for SP Cortex-M assembly large build with IAR (PR 6954)
  * Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947)
  * Fix for SP ARM64 P-256 for not inlining functions for iOS compatibilit
    (PR 6979)
  * Fix for WOLFSSL_CALLBACKS and potential memory error (PR 6949)
  * Fixes for wolfSSL’s Zephyr OS port (PR 6930)
  * Fix for build errors when building for NXP mmCAU (FREESCALE_MMCAU)
    (PR 6970)
  * Fix for TLS 1.3 SendBuffered() return code in non-blocking mode (PR 7001)
  * Fix for TLS Hmac_UpdateFinal() when padding byte is invalid (PR 6998)
  * Fix for ARMv8 AES-GCM streaming to check size of IV before storing
    (PR 6996)
  * Add missing calls to wc_AesInit() before wc_AesSetKey() (PR 7011)
  * Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976)
  * Fixes for building wolfSSL in Visual Studio (PR 7040)