CVE-2022-25638

MEDIUM

wolfssl < 5.2.0 - Certificate Validation Bypass via TLS 1.3 sig_algo Field Mismatch

Title source: llm
STIX 2.1

Description

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message.

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/wolfSSL/wolfssl/pull/4813
Vendor Advisory x_refsource_confirm
https://www.wolfssl.com/docs/security-vulnerabilities/

Scores

CVSS v3 6.5
EPSS 0.0062
EPSS Percentile 44.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-295
Status published
Products (1)
wolfssl/wolfssl < 5.2.0
Published Feb 24, 2022
Tracked Since Feb 18, 2026