If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when     connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying     Material) value when generating the session master secret. Using a potentially known IKM value when     generating the session master secret key compromises the key generated, allowing an eavesdropper to     reconstruct it and potentially allowing access to or meddling with message contents in the session. This     issue does not affect client validation of connected servers, nor expose private key information, but     could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL     recommends that TLS 1.3 client side users update the version of wolfSSL used. (CVE-2023-3724)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when
    connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying
    Material) value when generating the session master secret. Using a potentially known IKM value when
    generating the session master secret key compromises the key generated, allowing an eavesdropper to
    reconstruct it and potentially allowing access to or meddling with message contents in the session. This
    issue does not affect client validation of connected servers, nor expose private key information, but
    could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL
    recommends that TLS 1.3 client side users update the version of wolfSSL used. (CVE-2023-3724)

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-3724 advisory.

  - If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when     connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying     Material) value when generating the session master secret. Using a potentially known IKM value when     generating the session master secret key compromises the key generated, allowing an eavesdropper to     reconstruct it and potentially allowing access to or meddling with message contents in the session. This     issue does not affect client validation of connected servers, nor expose private key information, but     could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL     recommends that TLS 1.3 client side users update the version of wolfSSL used. (CVE-2023-3724)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
257970	Linux Distros Unpatched Vulnerability : CVE-2023-3724	Nessus	Misc.	Local	high
427691	Alpine: multiple wolfssl packages: security update to 5.6.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
427691	Alpine: multiple wolfssl packages: security update to 5.6.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
212833	CBL Mariner 2.0 Security Update: mariadb (CVE-2023-3724)	Nessus	MarinerOS Local Security Checks	Local	high

Detections

Analytics

CVE-2023-3724

high

Tenable Plugins

high

high

high

high