CVE-2022-25640: High severity wolfssl wolfmqtt vulnerability
Published Feb 24, 2022
·Updated
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate.
Affected Software
1 affected component
wolfSSL wolfssl<5.2.0
Remediation
Patch Available
Event History
Feb 24, 2022
CVE Published
via MITRE·01:07 AM
Data Sourced
via MITRE·01:07 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-25640.
2
What is the severity of CVE-2022-25640?
The severity of CVE-2022-25640 is high, with a severity value of 7.5.
3
How does CVE-2022-25640 affect wolfSSL?
CVE-2022-25640 affects wolfSSL versions up to and excluding 5.2.0.
4
What is the impact of CVE-2022-25640?
The impact of CVE-2022-25640 is that a TLS 1.3 server using wolfSSL may not be able to enforce mutual authentication properly.
5
Is there a fix available for CVE-2022-25640?
Yes, the fix for CVE-2022-25640 can be found in wolfSSL version 5.2.0 and later.