CVE-2023-3724

Summary

CVE-2023-3724 is a vulnerability affecting TLS 1.3 clients using wolfSSL. When connecting to a malicious server, if no Pre-Shared Key (PSK) or Key Share Extension (KSE) are provided, a predictable buffer is used for Input Keying Material (IKM), compromising the session master secret key. This allows eavesdropping and potential manipulation of message contents in the session. The vulnerability does not impact client validation of connected servers or expose private key information. wolfSSL advises users to update their wolfSSL version to mitigate this issue and ensure secure TLS 1.3 sessions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.