Security Flaw in Eclipse Californium Affecting DTLS Handshake Verification

CVE-2021-34433

What is CVE-2021-34433?

In specific versions of Eclipse Californium, DTLS handshakes can erroneously succeed without verifying the server's signature on the client side. This occurs if the signature is not included in the server's ServerKeyExchange message, potentially leading to security breaches where malicious servers may impersonate legitimate ones. Proper validation is crucial to ensure secure communications.

References