CVE-2023-3724

If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. wolfSSL recommends that TLS 1.3 client side users update the version of wolfSSL used. 

• CWE-20
• CWE-295

• https://github.com/wolfSSL/wolfssl/pull/6412Patch
• https://www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory
• https://github.com/wolfSSL/wolfssl/pull/6412Patch
• https://www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory

Published

Jul 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37232Loftware Spectrum through 4.6 exposes Sensitive Information …7.5
• CVE-2023-37233Loftware Spectrum before 4.6 HF14 allows authenticated XXE a…8.8
• CVE-2023-37234Loftware Spectrum through 4.6 has unprotected JMX Registry.9.8
• CVE-2023-37237In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure …7.2
• CVE-2023-37238Vulnerability of apps' permission to access a certain API be…5.3
• CVE-2023-37239Format string vulnerability in the distributed file system.…7.5
• CVE-2023-37240 Vulnerability of missing input length verification in the …9.1
• CVE-2023-37241Input verification vulnerability in the WMS API. Successful …7.5
• CVE-2023-37242Vulnerability of commands from the modem being intercepted i…9.8
• CVE-2023-37243The C:\Windows\Temp\Agent.Package.Availability\Agent.Package…7.8
• CVE-2023-37244The affected AutomationManager.AgentService.exe application …7
• CVE-2023-37245Buffer overflow vulnerability in the modem pinctrl module. S…9.1