CVE-2020-24585 — Wolfssl vulnerability

4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 53.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WolfsslDebian Wolfssl
Timeline
PublishedAug 21
Latest updateMay 24

Description

An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/wolfssl< wolfssl 4.5.0+dfsg-1 (bookworm)
▶NVDwolfssl/wolfssl< 4.5.0
▶Debianwolfssl/wolfssl< 4.5.0+dfsg-1+3

🔴Vulnerability Details

2
GHSA
GHSA-5vqc-37wg-fvq8: An issue was discovered in the DTLS handshake implementation in wolfSSL before 4↗2022-05-24
▶
OSV
CVE-2020-24585: An issue was discovered in the DTLS handshake implementation in wolfSSL before 4↗2020-08-21
▶

📋Vendor Advisories

1
Debian
CVE-2020-24585: wolfssl - An issue was discovered in the DTLS handshake implementation in wolfSSL before 4...↗2020
▶
CVE-2020-24585 — Wolfssl vulnerability | cvebase