CVE-2023-6937 is a medium-severity vulnerability affecting wolfSSL versions prior to 5.6.6. It stems from wolfSSL's failure to properly validate that messages within a single (D)TLS record do not span key boundaries, potentially allowing a wolfSSL client to accept unencrypted (D)TLS 1.3 handshake flights after the ServerHello. This could lead to a client accepting unencrypted data that should be encrypted. The vulnerability has a CVSS score of 5.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network-based exploitation with low attack complexity and a potential impact of limited confidentiality. Key negotiation and authentication are not compromised. Currently, there is no evidence of active exploitation, nor are there any known public exploits available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 5.6.4CPE match | cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* | ||
< 5.6.6CPE matchmatch criteria | cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.