CVE-2022-38152: wolfssl

csirt@kutim:~/threat-intel/cve/CVE-2022-38152

CVSS 7.5 · High EPSS 2,7%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada wolfssl. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.

Rincian

Terbit di NVD: 31 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-754: Improper Check for Unusual or Exceptional Conditions
EPSS (30 hari): 2,7% peluang dieksploitasi; lebih tinggi dari 85,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
wolfssl	wolfssl	Semua versi sebelum 5.5.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.wolfssl.com/docs/security-vulnerabilities/ advisory vendor
https://github.com/wolfSSL/wolfssl/pull/5468 exploit · patch · advisory pihak ketiga
http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.html exploit · advisory pihak ketiga
http://seclists.org/fulldisclosure/2023/Jan/7 exploit · mailing list · advisory pihak ketiga
https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/ advisory pihak ketiga
https://github.com/tlspuffin/tlspuffin not applicable
https://github.com/wolfSSL/wolfssl/releases release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.