CVE-2020-24585

EUVD-2020-17302
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
wolfsslwolfssl
𝑥
< 4.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wolfssl
bookworm
5.5.4-2+deb12u1
fixed
bullseye
4.6.0+p1-0+deb11u2
fixed
sid
5.7.2-0.1
fixed
trixie
5.7.2-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
wolfssl
bionic
needed
focal
needed
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
needed
References
https://github.com/wolfSSL/wolfssl/pull/3219
https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable
https://github.com/wolfSSL/wolfssl/pull/3219
https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable