This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-12457 →

DEBIAN-CVE-2020-12457

An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends...

Original description

The description as published by the source.

An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCipherSpec messages in a crafted way involving more than one in a row, the server becomes stuck in the ProcessReply() loop, i.e., a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 wolfssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0+dfsg-1"}]}]

Debian:13 wolfssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org