wolfSSL 5.x before 5.1.1 uses non-random IV values in...
Critical severity
Unreviewed
Published
Jan 19, 2022
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Description
Published by the National Vulnerability Database
Jan 18, 2022
Published to the GitHub Advisory Database
Jan 19, 2022
Last updated
Feb 3, 2023
wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c.
References