CVE-2020-24613: Medium severity wolfssl wolfmqtt vulnerability
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-24613?
CVE-2020-24613 refers to a vulnerability in wolfSSL before version 4.5.0 that mishandles TLS 1.3 server data in the WAIT_CERT_CR state.
How severe is CVE-2020-24613?
CVE-2020-24613 has a severity score of 6.8, which is considered medium.
How does CVE-2020-24613 affect Wolfssl?
CVE-2020-24613 affects Wolfssl versions up to but excluding version 4.5.0.
What is the impact of CVE-2020-24613?
CVE-2020-24613 allows attackers in a privileged network position to impersonate any TLS 1.3 server.
Is there a fix for CVE-2020-24613?
Yes, the fix for CVE-2020-24613 is to upgrade to version 4.5.0 or later of Wolfssl.