PT-2023-25848 · Wolfssl · Wolfssl

Johannes · Publicado 2023-07-17 · Atualizado 2023-07-28 · CVE-2023-3724

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description When a TLS 1.3 client connects to a malicious server without receiving a PSK (pre shared key) extension or a KSE (key share extension), it uses a default predictable buffer for the IKM (Input Keying Material) value. This compromises the generated session master secret key, allowing an eavesdropper to reconstruct it and potentially access or meddle with message contents. The issue does not affect client validation of connected servers or expose private key information but could result in an insecure TLS 1.3 session.

Recommendations Update the version of wolfSSL used to resolve the issue. As a temporary workaround, consider restricting connections to trusted servers to minimize the risk of exploitation.

Correção

RCE

Improper Certificate Validation

Enumeração de Fraquezas

CWE-20

CWE-295

Identificadores relacionados

AZL-27649

CVE-2023-3724

Produtos afetados

Wolfssl

Referências · 10

• https://github.com/wolfSSL/wolfssl/pull/6412 · Correção
• https://ubuntu.com/security/CVE-2023-3724 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-3724 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-3724 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3724 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-3724 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2023-3724 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3724 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-27649 · Aviso do Fabricante
• https://wolfssl.com/docs/security-vulnerabilities · Aviso do Fabricante