Anyone using DTLS with wolfSSL versions prior to release 4.5.0.
An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application.
Update to wolfSSL version 4.5.0.
The research for this vulnerability is not yet publicly available, a public disclosure containing more details is currently scheduled for November 15th, 2020. CVE-2020-24585 has been reserved for when the public disclosure is made available.
More available upon public disclosure of research. The patch fixing this issue can be viewed at this link:
Please contact firstname.lastname@example.org if you have any questions.