CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers.

• CWE-295

• https://research.nccgroup.com/2020/08/24/technical-advisory-wolfssl-tls-1-3-client-man-in-the-middle-attack/Exploit, Third Party Advisory
• https://research.nccgroup.com/2020/08/24/technical-advisory-wolfssl-tls-1-3-client-man-in-the-middle-attack/Exploit, Third Party Advisory

Published

Aug 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24601In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulner…6.1
• CVE-2020-24602Ignite Realtime Openfire 4.5.1 has a reflected Cross-site sc…6.1
• CVE-2020-24604A Reflected XSS vulnerability was discovered in Ignite Realt…6.1
• CVE-2020-24606Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer…7.5
• CVE-2020-24609TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and ear…6.1
• CVE-2020-24612An issue was discovered in the selinux-policy (aka Reference…4.7
• CVE-2020-24614Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x befor…8.8
• CVE-2020-24615Pexip Infinity before 24.1 has Improper Input Validation, le…5.3
• CVE-2020-24616FasterXML jackson-databind 2.x before 2.9.10.6 mishandles th…8.1
• CVE-2020-24617Mailtrain through 1.24.1 allows SQL Injection in statsClicke…8.8
• CVE-2020-24618In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11…6.5
• CVE-2020-24619In mainwindow.cpp in Shotcut before 20.09.13, the upgrade ch…5.9