ALT-PU-2022-3515-1
Package wolfssl updated to version 5.1.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2022-01-19
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23408
wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c.
Severity: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References: