vulnerability

Debian: CVE-2020-24613: wolfssl -- security update

Severity
5
CVSS
(AV:N/AC:M/Au:S/C:P/I:P/A:N)
Published
08/24/2020
Added
07/30/2024
Modified
07/30/2024

Description

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.

Solution

debian-upgrade-wolfssl
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.