Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1271191

Bug#1121200: wolfssl: CVE-2025-11935

Show all headers | View raw

Source: wolfssl
Version: 5.8.2-1.2
Severity: important
Tags: security upstream
Forwarded: https://github.com/wolfSSL/wolfssl/pull/9112
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for wolfssl.

CVE-2025-11935[0]:
| With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could
| ignore the request for PFS (perfect forward secrecy) and the client
| would continue on with the connection using PSK without PFS. This
| happened when a server responded to a ClientHello containing
| psk_dhe_ke without a key_share extension. The re-use of an
| authenticated PSK connection that on the clients side unexpectedly
| did not have PFS, reduces the security of the connection.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-11935
    https://www.cve.org/CVERecord?id=CVE-2025-11935
[1] https://github.com/wolfSSL/wolfssl/pull/9112
[2] https://github.com/wolfSSL/wolfssl/commit/cd55fe613566c6eaf358f2796692ee5f24b55c0e

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#1121200: wolfssl: CVE-2025-11935 Salvatore Bonaccorso <carnil@debian.org> - 2025-11-22 16:40 +0100

csiph-web