Unscored CVE-2022-25638 EUVD-2022-30298GHSA-xxrj-j9r7-g9q6

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. Th…

Published Feb 24, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: wolfssl Package: wolfssl Ecosystem: Debian Ecosystem: Ubuntu

Description

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	wolfssl	5.2.0-1	—
Debian 12	wolfssl	5.2.0-1	—

Ubuntu