Log in Start free

Vulnerability · Published Aug 27, 2024 · Assigned by wolfSSL

CVE-2024-5814Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade

Medium 5.1

In plain English

A medium-severity improper access control in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.5%top 59.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wolfsslno fix listedDEBIAN-CVE-2024-5814
Debian:13wolfssl5.7.2-0.1DEBIAN-CVE-2024-5814
Ubuntu:22.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-5814
Ubuntu:24.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-5814
Ubuntu:25.10wolfsslno fix listedUBUNTU-CVE-2024-5814
Ubuntu:26.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-5814
Ubuntu:26.10wolfsslno fix listedUBUNTU-CVE-2024-5814

Affected products (as reported)

VendorProductVersions
wolfSSL wolfSSL 0 – through 5.7.0

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/V:D/RE:M/U:Green

References