Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper key_share validation in TLS 1.3 HelloRetryRequest
Vulnerability Description
Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.
CVSS Information
N/A
Vulnerability Type
输入验证不恰当
Vulnerability Title
wolfSSL（CyaSSL） 安全漏洞
Vulnerability Description
wolfSSL（CyaSSL）是美国wolfSSL公司的一个针对嵌入式系统开发人员使用的小的、可移植的嵌入式SSL编程库。 wolfSSL（CyaSSL）存在安全漏洞，该漏洞源于TLS 1.3客户端HelloRetryRequest握手逻辑缺少必要的加密步骤，可能导致通过特制的HelloRetryRequest和省略key_share扩展的ServerHello消息，从(EC)DHE共享密钥推导出可预测的流量密钥，从而破坏TLS保护通信的机密性。
CVSS Information
N/A
Vulnerability Type
N/A