wolfSSL up to 5.6.4 TLS Record information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in wolfSSL up to 5.6.4. This affects an unknown part of the component TLS Record Handler. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2023-6937. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in wolfSSL up to 5.6.4 and classified as problematic. This vulnerability affects some unknown functionality of the component TLS Record Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating.

The weakness was presented 02/15/2024 by Johannes Wilson. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-6937 since 12/18/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 212790 (CBL Mariner 2.0 Security Update: mariadb (CVE-2023-6937)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.6.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (212790). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• wolfSSL

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4

License

• open-source

Website

• Product: https://github.com/wolfSSL/wolfssl/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion