CVE-2020-24585 Security feature bypass in n/a
Attackers can bypass DTLS epoch checks in wolfSSL, causing clear application data to be processed incorrectly instead of being rejected.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24585?
CVE-2020-24585 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 21 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
Which versions are affected by CVE-2020-24585?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2020-24585?
Upgrade to a fixed version.
Is CVE-2020-24585 being exploited?
There is no known exploitation of CVE-2020-24585 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2020-24585, GHSA-5vqc-37wg-fvq8, UBUNTU-CVE-2020-24585.