CVE-2023-3724
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
CVE-2023-3724 affects TLS 1.3 clients that do not receive a PSK or KSE extension when connecting to a malicious server. In this case, a default predictable buffer is used for the IKM value, which may lead to session key compromise.
Risk Assessment
Compromise of the session key may allow an eavesdropper to reconstruct the key and potentially access or meddle with message contents in the session. While it does not affect server validation, it could result in an insecure TLS 1.3 session.
Recommendation
It is recommended that TLS 1.3 client users update the version of wolfSSL they are using to mitigate the risks associated with this vulnerability.
Other vulnerabilities in wolfSSL
See all- CVE-2017-13099High
wolfSSL versions prior to 3.12.2 provide a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application.
- CVE-2017-8855High
wolfSSL versions before 3.11.0 do not prevent wc_DhAgree from accepting a malformed DH key.
- CVE-2017-8854High
wolfSSL versions before 3.10.2 have an out-of-bounds memory access issue when loading crafted DH parameters, leading to a buffer overflow triggered by a malformed temporary DH file.
- CVE-2015-6925High
wolfSSL versions (formerly CyaSSL) before 3.6.8 are vulnerable to a denial of service attack that can be triggered by a crafted DTLS cookie in a ClientHello message.
- CVE-2017-2800Critical
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution.
- CVE-2026-8720High
The wc_Blake2bHmacFinal and wc_Blake2sHmacFinal functions in the wolfSSL library have an issue when the key length exceeds the block size, resulting in a MAC that is independent of the input data. When a key is too long, the hashing state is reset, causing the loss of message data.
- CVE-2026-7532High
A vulnerability in the wolfSSL library allows bypassing IP address name constraints when the WOLFSSL_IP_ALT_NAME macro is not defined. In this configuration, a certificate can violate IP address constraints imposed by a certificate authority.
- CVE-2026-6678Medium
Integer underflow in wc_PKCS7_DecryptOri when processing crafted Other Recipient Info, leading to incorrect length handling during decryption.
- CVE-2026-5263Medium
A vulnerability in the wolfSSL library causes URI nameConstraints from constrained intermediate CAs to be parsed but not enforced during certificate chain verification. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.
Original NVD description (English source)
If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used.