Cryptographic issues in wolfSSL - CVE-2023-6937
Published: December 28, 2023
Vulnerability identifier: #VU84841
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-6937
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to wolfSSL does not check that messages in a single (D)TLS record do not span key boundaries. As a result, it is possible to combine (D)TLS messages using different keys into one (D)TLS record and force the client to accept an unencrypted flight from the server.
Affected software
wolfSSL
How to mitigate CVE-2023-6937
Install updates from vendor's website.
wolfSSL - update to 5.6.6