CVE-2022-25638
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs w...
Original description
The description as published by the source.
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-25638 wolfssl Fixed in: 4.6.0+p1-0+deb11u1
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web wolfssl.com