Vulnerability · Published Aug 27, 2024 · Assigned by wolfSSL
CVE-2024-5814Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade
Medium 5.1
In plain English
A medium-severity improper access control in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2024-5814 |
| Debian:13 | wolfssl | 5.7.2-0.1 | DEBIAN-CVE-2024-5814 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2024-5814 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2024-5814 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2024-5814 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2024-5814 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2024-5814 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/V:D/RE:M/U:Green