Background

The wolfSSL Python package (wolfssl-py) is a widely used library that provides SSL/TLS functionality for Python applications. It is designed to enable secure communication over networks by implementing various cryptographic protocols. The package is known for its lightweight design and is often utilized in embedded systems and IoT devices. However, a critical vulnerability has been identified that compromises the integrity of mutual TLS (mTLS) client authentication.

Vulnerability Detail

A vulnerability exists in the wolfSSL Python package due to improper handling of the verify_mode setting when set to CERT_REQUIRED. Specifically, the absence of the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag leads to a situation where client certificate requirements are not fully enforced. As a result, if a client does not present a certificate during the TLS handshake, the connection is incorrectly authenticated, allowing attackers to bypass mTLS client authentication. This vulnerability affects all versions up to and including 5.8.2, posing a significant security risk.

pip install --upgrade "wolfssl==5.8.4-stable"

Workaround

As a temporary workaround, you can manually enforce client certificate validation in your application code by checking for the presence of a client certificate before proceeding with the connection. However, this is not a substitute for updating to the patched version. Example code snippet:

import wolfssl

Custom function to check for client certificate

def check_client_certificate(cert):

if cert is None:
    raise Exception('Client certificate is required for authentication.')

Usage in your TLS connection setup

client_cert = get_client_certificate() # Replace with your method to retrieve the client certificate check_client_certificate(client_cert)

Conclusion

The wolfSSL Python module has a critical vulnerability that allows improper authentication due to the lack of enforcement of client certificate requirements. It is crucial to update to the patched version 5.8.4-stable to mitigate this risk. Additionally, users can utilize Vulert for ongoing monitoring of vulnerabilities in their applications.

See every vulnerability recorded for wolfssl →

FAQ