CVE-2022-25638: Medium severity wolfssl wolfmqtt vulnerability
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sigalgo field differs between the certificateverify message and the certificate message.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-25638?
CVE-2022-25638 is a vulnerability in wolfSSL before 5.2.0 that allows certificate validation to be bypassed during attempted authentication.
How does CVE-2022-25638 impact wolfSSL?
CVE-2022-25638 impacts wolfSSL by allowing a TLS 1.3 client to bypass certificate validation during authentication.
What is the severity of CVE-2022-25638?
The severity of CVE-2022-25638 is medium, with a severity value of 6.5.
How can I fix CVE-2022-25638?
You can fix CVE-2022-25638 by updating wolfSSL to version 5.2.0 or higher.
Are there any references for CVE-2022-25638?
Yes, you can find references for CVE-2022-25638 at the following links: [GitHub](https://github.com/wolfSSL/wolfssl/pull/4813) and [wolfSSL website](https://www.wolfssl.com/docs/security-vulnerabilities/).