CVE-2020-24613 wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c.

What is CVE-2020-24613?

CVE-2020-24613 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 24 Aug 2020.

Official description

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.

Weakness: CWE-295

Which versions are affected by CVE-2020-24613?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2020-24613?

Upgrade to a fixed version.

Is CVE-2020-24613 being exploited?

There is no known exploitation of CVE-2020-24613 in the wild and no public exploit code.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-24613, GHSA-m4j6-ffw6-5r4m, UBUNTU-CVE-2020-24613.