CVE-2022-23408

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.x prior to 5.1.1

Description The issue affects connections without AEAD that use AES-CBC or DES3 with TLS versions 1.1 or 1.2 or DTLS versions 1.1 or 1.2. This occurs due to misplaced memory initialization in the BuildMessage function in the internal.c file. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For wolfSSL versions 5.x prior to 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of AES-CBC or DES3 with TLS versions 1.1 or 1.2 or DTLS versions 1.1 or 1.2 until a patch is available. Avoid using connections without AEAD until the issue is resolved.