PT-2022-17425 · Wolfssl+1 · Wolfssl+1

Aina Toky Rasoamanana + 1 · Published 2022-02-21 · Updated 2023-01-12 · CVE-2022-25638

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.2.0

Description The issue allows certificate validation to be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig algo field differs between the certificate verify message and the certificate message.

Recommendations For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider restricting TLS 1.3 connections until a patch is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2022-1361

ALT-PU-2023-1034

CVE-2022-25638

Affected Products

Alt Linux

Wolfssl

References · 12

• https://github.com/wolfSSL/wolfssl/pull/4813 · Patch
• https://osv.dev/vulnerability/CVE-2022-25638 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25638 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-25638 · Security Note
• https://ubuntu.com/security/CVE-2022-25638 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25638 · Vendor Advisory
• https://wolfssl.com/docs/security-vulnerabilities · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-25638 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/commit/e13861bcde8015bb99ddb034224afb66e2fb89b8 · Note
• https://github.com/wolfSSL/wolfssl/commit/08047b2d959ee5e21a4a2c672308f45fec61f059 · Note
• https://t.me/cibsecurity/38018 · Telegram Post