CVE-2023-6937

What it actually does

wolfSSL clients prior to 5.6.6 fail to enforce that all messages within a single (D)TLS record use the same encryption keys, allowing an attacker-controlled server to place an unencrypted ServerHello followed by the remainder of the first server flight into one record that the client accepts even though TLS 1.3 requires encryption after ServerHello.

Why it matters to the business

Low-risk exposure limited to potential leakage of handshake metadata in edge-case TLS 1.3 scenarios; does not affect key negotiation or authentication and therefore carries minimal operational or compliance consequences for organizations using affected wolfSSL versions.

How an attack unfolds

An attacker positioned as a TLS server sends a single record containing both an unencrypted ServerHello and subsequent handshake messages that should have been encrypted; a vulnerable wolfSSL client accepts the record without verifying key boundaries, though the flaw cannot be leveraged to compromise session keys or authentication.

How to fix it

Upgrade wolfSSL to the version containing commit 66596ad9e1d7efa8479656872cf09c9c1870a02e (equivalent to release 5.6.6 or later) in all products and rebuild any statically linked binaries; verify the updated library is loaded at runtime.

How to confirm the fix worked

Confirm the running wolfSSL library reports version 5.6.6 or newer, or inspect the source/build for presence of commit 66596ad9e1d7efa8479656872cf09c9c1870a02e; perform a TLS 1.3 handshake test that attempts to send a mixed-key record and verify the client now rejects it.

Typical attack path

1. Attacker establishes a network position able to serve TLS traffic to the target client
2. Attacker constructs a TLS 1.3 ServerHello record that also contains the remainder of the first flight using the pre-ServerHello key
3. Client accepts the mixed-key record and continues the handshake
4. Attacker observes or influences subsequent handshake behavior without obtaining cryptographic material

How to detect it

Review TLS handshake logs or packet captures for ServerHello records that continue with additional handshake messages under the pre-ServerHello cipher; correlate with client version strings indicating wolfSSL < 5.6.6; no persistent artifacts are created on disk.

What your security team should do

• Prioritize patching any internet-facing or high-value clients that embed wolfSSL within the next maintenance window
• Inventory all products and dependencies that statically or dynamically link wolfSSL and schedule upgrades
• Add wolfSSL version checks to continuous-integration and container-scanning pipelines
• Monitor upstream wolfSSL release notes for any related follow-on fixes