Threats tagged 'ghsa-gq94-hf88-g4wv'

A vulnerability in wolfSSL's TLS 1.3 post-handshake authentication (PHA) allows a server to accept a client's Finished message without the client sending the required Certificate and CertificateVerify messages when PHA is enabled. This issue arises because an exemption meant only for the initial handshake was incorrectly applied during post-handshake CertificateRequest. Only TLS 1.3 servers built with PHA support and configured to request client certificates after the handshake are affected. Clients and servers not using PHA are not impacted.