CVE catalog

CVE-2023-3724

wolfssl affected and fixed versions

If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used.

Severity: Medium
Published: Jul 17, 2023, 10:15:09 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.65% · Oct 27, 2026

Projects and upstream resources

[wolfssl][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	wolfssl	`5.5.4-2.1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debiantrixie	wolfssl	`5.7.2-0.1+deb13u2`	Fixed	[CVE-2023-3724]
Debiansid	wolfssl	`5.5.4-2.1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debiansid	wolfssl	`5.9.2-1.2`	Fixed	[CVE-2023-3724]
Debianbookworm-security	wolfssl	`5.5.4-2+deb12u3`	Fixed	[CVE-2023-3724]
Debianbookworm	wolfssl	`5.5.4-2+deb12u1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debianbookworm	wolfssl	`5.5.4-2+deb12u2`	Fixed	[CVE-2023-3724]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	wolfssl	`5.5.4-2+deb12u1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debianbookworm	wolfssl	`5.5.4-2+deb12u2`	Fixed	[CVE-2023-3724]
Debianbookworm-security	wolfssl	`5.5.4-2+deb12u3`	Fixed	[CVE-2023-3724]
Debiansid	wolfssl	`5.5.4-2.1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debiansid	wolfssl	`5.9.2-1.2`	Fixed	[CVE-2023-3724]
Debiantrixie	wolfssl	`5.5.4-2.1`	FixedDistribution-reported fixed boundary	[CVE-2023-3724]
Debiantrixie	wolfssl	`5.7.2-0.1+deb13u2`	Fixed	[CVE-2023-3724]

Original provider fields

{
  "package_releases": [
    {
      "name": "wolfssl",
      "status": "fixed",
      "release": "sid",
      "version": "5.9.2-1.2"
    },
    {
      "name": "wolfssl",
      "status": "fixed",
      "release": "trixie",
      "version": "5.7.2-0.1+deb13u2"
    },
    {
      "name": "wolfssl",
      "status": "fixed",
      "release": "bookworm",
      "version": "5.5.4-2+deb12u2"
    },
    {
      "name": "wolfssl",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "5.5.4-2+deb12u3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1041699,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.5.4-2.1"
    },
    {
      "bug": 1041699,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.5.4-2.1"
    },
    {
      "bug": 1041699,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.5.4-2+deb12u1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #1041699]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libwolfssl35]Unknown
Source package: [wolfssl]
Details (4)
- 5.5.4-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
[libwolfssl-dev]Unknown
Source package: [wolfssl]
Details (4)
- 5.5.4-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 5.5.4-2+deb12u1
  dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

[Debian 13 (Trixie)]

[libwolfssl42t64]Unknown
Source package: [wolfssl]
Details (2)
- 5.7.2-0.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 5.5.4-2.1
  dsa · wolfssl · debian · 13
- 5.7.2-0.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 5.5.4-2.1
  dsa · wolfssl · debian · 13
[libwolfssl-dev]Unknown
Source package: [wolfssl]
Details (2)
- 5.7.2-0.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 5.5.4-2.1
  dsa · wolfssl · debian · 13
- 5.7.2-0.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 5.5.4-2.1
  dsa · wolfssl · debian · 13

Observed: Oct 28, 2026, 5:44:52 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]