CVE-2020-12457

Published: Aug 21, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCipherSpec messages in a crafted way involving more than one in a row, the server becomes stuck in the ProcessReply() loop, i.e., a denial of service.

Affected (1)

Products: Wolfssl: Wolfssl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wolfssl Wolfssl	Before 4.5.0

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (4)

https://github.com/wolfSSL/wolfssl/pull/2927

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable

Source: cve@mitre.org

Third Party Advisory

https://github.com/wolfSSL/wolfssl/pull/2927

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/wolfSSL/wolfssl/releases/tag/v4.5.0-stable

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.