CVE-2024-5814 — Improper Access Control in Wolfssl

CWE-284 — Improper Access Control5 documents5 sources
Severity
5.1MEDIUMNVD
EPSS
0.2%
top 55.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
WolfsslDebian WolfsslMsrc Azure Linux 3.0 ARM+3 more
Timeline
PublishedAug 27

Description

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages7 packages

▶debiandebian/wolfssl< wolfssl 5.7.2-0.1 (forky)
▶Debianwolfssl/wolfssl< 5.7.2-0.1+1
▶NVDwolfssl/wolfssl5.7.0

🔴Vulnerability Details

2
GHSA
GHSA-8cr7-x5g8-m3f3: A malicious TLS1↗2024-08-27
▶
OSV
CVE-2024-5814: A malicious TLS1↗2024-08-27
▶

📋Vendor Advisories

2
Microsoft
Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade↗2024-08-13
▶
Debian
CVE-2024-5814: wolfssl - A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to...↗2024
▶
CVE-2024-5814 — Improper Access Control in Wolfssl | cvebase