PT-2022-15979 · Wolfssl+1 · Wolfssl+1

Published 2022-01-04 · Updated 2022-01-27 · CVE-2022-23408

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.x prior to 5.1.1

Description The issue affects connections without AEAD that use AES-CBC or DES3 with TLS versions 1.1 or 1.2 or DTLS versions 1.1 or 1.2. This occurs due to misplaced memory initialization in the BuildMessage function in the internal.c file. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For wolfSSL versions 5.x prior to 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of AES-CBC or DES3 with TLS versions 1.1 or 1.2 or DTLS versions 1.1 or 1.2 until a patch is available. Avoid using connections without AEAD until the issue is resolved.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

ALT-PU-2022-1006

CVE-2022-23408

Affected Products

Alt Linux

Wolfssl

References · 11

• https://cve.org/CVERecord?id=CVE-2022-23408 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23408 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23408 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23408 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23408 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23408 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-511-jan-3rd-2022 · Note
• https://github.com/wolfSSL/wolfssl/pull/4710 · Note
• https://t.me/cvenotify/25625 · Telegram Post
• https://t.me/cibsecurity/35751 · Telegram Post