TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

CVE-2023-3724

Summary

A vulnerability in the TLS 1.3 implementation of wolfSSL allows a potentially insecure session to be established under specific conditions. If a client does not receive the necessary extensions (PSK or KSE) when connecting to a malicious server, a default buffer may be utilized to generate the Input Keying Material (IKM). This predictable IKM can compromise the session master secret, granting eavesdroppers the ability to reconstruct the key and potentially access or manipulate message contents. While the issue does not compromise server validation or leak private keys, it highlights the importance of controlling both sides of a TLS 1.3 connection. wolfSSL strongly advises users to update to the latest version to mitigate this risk.

References