CVE-2024-5814: Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5814?
CVE-2024-5814 has been rated as a high severity vulnerability due to its potential to enable unauthorized ciphersuite negotiation.
How do I fix CVE-2024-5814?
To fix CVE-2024-5814, it is recommended to update to wolfSSL version 5.7.1 or later.
Which software is affected by CVE-2024-5814?
CVE-2024-5814 affects wolfSSL versions up to and including 5.7.0.
What type of attack does CVE-2024-5814 enable?
CVE-2024-5814 enables a downgrade attack where a malicious server can force a client to use an undesired ciphersuite.
How can I determine if my application is vulnerable to CVE-2024-5814?
To determine if your application is vulnerable to CVE-2024-5814, check if it uses wolfSSL versions up to 5.7.0 and assess its TLS1.3 downgrade capability.