CVE-2022-39173

    Dashboard / Vulnerabilities / CVE-2022-39173

    CVE-2022-39173

    Published: 29 Sept 2022Last Modified: 12 Aug 2026

    Summary:

    Details: In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.

    References: http://packetstormsecurity.com/files/169600/wolfSSL-Buffer-Overflow.html, https://www.wolfssl.com/docs/security-vulnerabilities/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39173.json, https://nvd.nist.gov/vuln/detail/CVE-2022-39173, https://github.com/wolfSSL/wolfssl/releases, http://seclists.org/fulldisclosure/2022/Oct/24, https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f1e2165c591f074feb47872a8ff712713ec411e1

    Affected versions

    WCv5.0-RC12

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39173 | CVE-DB