Affected Users:
Anyone using DTLS with wolfSSL versions prior to release 4.5.0.
Summary:
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
Recommendation:
Update to wolfSSL version 4.5.0.
Research:
The research for this vulnerability is not yet publicly available, a public disclosure containing more details is currently scheduled for November 15th, 2020. CVE-2020-24585 has been reserved for when the public disclosure is made available.
Additional Details:
More available upon public disclosure of research. The patch fixing this issue can be viewed at this link:
https://github.com/wolfSSL/wolfssl/commit/3be7f3e
Please contact support@wolfssl.com if you have any questions.