#VU84838 Use of a broken or risky cryptographic algorithm in wolfSSL
Published: December 28, 2023
Vulnerability identifier: #VU84838
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-327
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
wolfSSL
wolfSSL
Software vendor:
wolfSSL
wolfSSL
Description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of weak cryptographic ciphers susceptible to a Bleichenbacher style attack. A remote attacker can decrypt a saved TLS connection and potentially forge a signature after probing with a large number of trial connections.
Note, this issue is around RSA decryption and affects static RSA cipher suites on the server side, which are not recommended to be used and are off by default.
Remediation
Install updates from vendor's website.